Malicious
fc6a98840bbe2ff4e3c818544a0961a7
LNK File
MD5: fc6a98840bbe2ff4e3c818544a0961a7
Size: 3.59 KB
application/x-ms-shortcut
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | fc6a98840bbe2ff4e3c818544a0961a7 |
| Sha1 | 1c0e1071242f8a351aac0bbea39930d69617ca64 |
| Sha256 | 041619c550dd329d99cbb1b6f6bd5d3b06fcee2d26ddc0cecdbe45538182b0bd |
| Sha384 | f46954e0ce11f5aaa253c7a7a05f20c927bc3a7bb2d558b173156171e4487e0b516c762f8a7157c358c103dbaa434a17 |
| Sha512 | f818d3015376cee1796b3284c03733b0646411dfdbdc6bc2d39f3b9e0b19774fd355dacbfc5364ddfdc371fd1c919793cc750d94bbe99e9780a9a9487c954408 |
| SSDeep | 48:8ja+Zx28Yc0C8wVdsyAYiHYEC+m1cd00E2/XuH96BPozq4:8ja+YQ8w34YiHpC+iafudIPozq |
| TLSH | EB71DC2117F50308E3B76B39ADB7B5219873BD65FE32CFCE4090424E1962624D46AF2B |
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
lnk~T1027~T1059.001~T1059.003~T1105~T1202~T1204.002~T1218>lnk:cmd~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105
Shape
lnk>lnk:cmd>scr:ps1
malicious
3 nodes
Path
lnk~T1027~T1059.001~T1059.003~T1105~T1202~T1204.002~T1218>scr:ps1~T1027~T1059.001
Shape
lnk>scr:ps1
malicious
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
-commahuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$u = "huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
-commahuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$u = "huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
fc6a98840bbe2ff4e3c818544a0961a7
Deobfuscated PowerShell
UNKNWOWNmalicious
-commahuhuhuhuhuhuhuhuhuhuhu
fc6a98840bbe2ff4e3c818544a0961a7 › LNK CommandLine
Deobfuscated PowerShell
UNKNWOWNmalicious
$u = "huhuhuhuhuhuhuhuhuhuhu
fc6a98840bbe2ff4e3c818544a0961a7 › LNK CommandLine › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
-commahuhuhuhuhuhuhuhuhuhuhu
fc6a98840bbe2ff4e3c818544a0961a7 › LNK CommandLine › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
$u = "huhuhuhuhuhuhuhuhuhuhu
fc6a98840bbe2ff4e3c818544a0961a7 › LNK CommandLine › [PowerShell Command] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.