Search tag:LNK | Malva.RE

Microsoft Office document

2313837f1ac6059e8a0c82f9fd33dbfb

MD5 2313837f1ac6059e8a0c82f9fd33dbfb · SHA256 7ec8a37604d9119055090f201a07f54619c29ccbdf[...]a07

CAB:COMPRESSION:MSZIP Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:%ComSpec%Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Managed .NET

7.73 MB yesterday

Malicious

Microsoft Office document

396f1b3ec53070261ed205db297dfdc8

MD5 396f1b3ec53070261ed205db297dfdc8 · SHA256 fd133e64799ab52e50eb290d44e446c426a9f91096[...]8e2

CAB:COMPRESSION:MSZIP Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:%ComSpec%Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Managed .NET

8.37 MB yesterday

Malicious

Shortcut Link File

a92a7b0a8659c94870684d402a18e0eb

MD5 a92a7b0a8659c94870684d402a18e0eb · SHA256 d511b6fe91ef43489335dd7608784648506a2cfff5[...]3ef

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

2.48 KB 4 days ago

Malicious

Shortcut Link File

e887bd3da38db284176b6644523f58a9

MD5 e887bd3da38db284176b6644523f58a9 · SHA256 c9008ac942ce5ac425fa41870069bc1a06a5561e1d[...]9e6

Malicious T1218 LNK: Script Execution

1.36 KB 4 days ago

Malicious

Shortcut Link File

80e69052f5d6b63cffa71d6a2085e9bd

MD5 80e69052f5d6b63cffa71d6a2085e9bd · SHA256 536836cbe5ff44f996a7bd2b0b85c19bef6a881a21[...]ece

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

2.47 KB 5 days ago

Malicious

Shortcut Link File

754307f619eb7f09210b95c0361a13bf

MD5 754307f619eb7f09210b95c0361a13bf · SHA256 3147f07bd6405ecafa1c40012524ab48aa62234e95[...]385

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002

2.03 KB 5 days ago

Malicious

Rar archive

e54394789073266fda74a830c558030f

MD5 e54394789073266fda74a830c558030f · SHA256 97ed374fe4ea6c8bd095f4402a4afb94d0fd33eaff[...]8cc

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002

817.15 KB 6 days ago

Suspect

ZIP archive

9b12193eafd58af055f425227fa1977d

MD5 9b12193eafd58af055f425227fa1977d · SHA256 2e2612d964aaf92e7b57bccab58349518bcdfd3a3f[...]16c

PE File Layout PDB Path

453.07 KB 8 days ago

Malicious

Microsoft Office document

86ff94ddf45a0391c9d3b5a4cf86df8b

MD5 86ff94ddf45a0391c9d3b5a4cf86df8b · SHA256 a8d7e195089b11db3c3c362a4f81b0eb6dc502f204[...]a35

CAB:COMPRESSION:MSZIP Archive 7z non extractible (chiffrée, corrompue ou vide)PE File Layout PDB Path UPX DeObfuscated VBScript T1059.005 Obfuscated T1027C2 https[:]//peazip.github.ioC2 https[:]//peazip.sourceforge.ioC2 https[:]//en.wikipedia.org/wiki/ISO_3166-1[...]a-2

28.77 MB 9 days ago

Malicious

ZIP archive

a1dcc40ddf65d338fd250de1b280db1a

MD5 a1dcc40ddf65d338fd250de1b280db1a · SHA256 4adb8b4f38f0199a238831a9c8892bae329b8737e5[...]106

SVG Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:conhost.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNKC2 https[:]//blockworks.com/event/digital-ass[...]donC2 https[:]//blockworks.com/event/digital-ass[...]ersC2 https[:]//luma.com/z7g0eoa3

553.66 KB 10 days ago

Malicious

ZIP archive

0aa928627088f5789901d16cae62d5a8

MD5 0aa928627088f5789901d16cae62d5a8 · SHA256 a355496c47d79ab9ad373d34192e1d475806686424[...]2be

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:conhost.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

837.35 KB 11 days ago

Malicious

ZIP archive

111d4f831f1f7b69c1e19910f0af3c5e

MD5 111d4f831f1f7b69c1e19910f0af3c5e · SHA256 725fa840a70c47196797db5977b2d99654063d0131[...]3cc

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001C2 https[:]//shorturl.at/1YNAJC2 https[:]//egrul.nalog.ru

902.33 KB 11 days ago

Malicious

Shortcut Link File

19a610a42153432e1e7d3d78a271c910

MD5 19a610a42153432e1e7d3d78a271c910 · SHA256 429a19e94becd3548a084678fe5e557189469f0eeb[...]d98

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001C2 http[:]//fcxfcxfcxfcxnobodywillfoll[...]xbb.fcxphp

59.56 KB 11 days ago

Malicious

ZIP archive

f0ddf536e91224a634463a39e366c5e0

MD5 f0ddf536e91224a634463a39e366c5e0 · SHA256 1b519c70fe1f04dfed8e09bbbd7deb376b9c7bc6ce[...]6f2

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 PE File Layout PDB Path

149.85 KB 11 days ago

Malicious

ZIP archive

0cae9689f6dcc1b23586493be5cbd71f

MD5 0cae9689f6dcc1b23586493be5cbd71f · SHA256 5a15f996dd4157ea7e88ed80d6a77dfcdd81f54305[...]1b4

PE File Layout PDB Path Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002

149.52 KB 11 days ago

Malicious

ZIP archive

5610d3d379019cdc1c95840d6870a86e

MD5 5610d3d379019cdc1c95840d6870a86e · SHA256 92589172ef4b160bfe6a56ecf224d6be7c1c259923[...]0d8

Corrupted Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK

38.57 KB 11 days ago

Malicious

Disk image

e78d3ab5cd893d4b70bb7d44257b7aef

MD5 e78d3ab5cd893d4b70bb7d44257b7aef · SHA256 247b3244ccbb8e33ebba0d3aa66a38f66cfe7d27d9[...]10e

PE File Layout PDB Path Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002

7.34 MB 11 days ago

Malicious

Shortcut Link File

a3da3cad3b4b18a261ce07a9c1669297

MD5 a3da3cad3b4b18a261ce07a9c1669297 · SHA256 211bfcba152a000b2bcdc8e33dc0a53c3830abda5f[...]25f

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

3.9 KB 11 days ago

Malicious

ZIP archive

a720afd7aa01d93e7f845d6f9a22b538

MD5 a720afd7aa01d93e7f845d6f9a22b538 · SHA256 2bc7c63838f751786cb5bfc3e885e7622b6958f99e[...]591

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

1.44 KB 11 days ago

Malicious

ZIP archive

7bf14df8aef9f0d21f2c30759f82dab5

MD5 7bf14df8aef9f0d21f2c30759f82dab5 · SHA256 ee39f091a23c746763ff44a273d11307abe5ca531f[...]37b

Malicious Execution: PowerShell in LNK T1059.001 T1204.002 PowerShell Batch Command PowerShell Call T1027 DeObfuscated

1.93 KB 16 days ago

Suspect

ZIP archive

e5b913be1f0f44b7834ae37936fea8b5

MD5 e5b913be1f0f44b7834ae37936fea8b5 · SHA256 9a8701b2552a6168c0834ec54019240176ed6bf6bb[...]5af

1.17 KB 16 days ago

Malicious

Disk image

3ec7d2e887666514c781dd17b3096707

MD5 3ec7d2e887666514c781dd17b3096707 · SHA256 dc43888143966d230f80a565839c62f22049f5ea80[...]2c2

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 PowerShell T1059.001

61.44 KB 17 days ago

Malicious

ZIP archive

29ee8947a745908d4b96295149dcf2fa

MD5 29ee8947a745908d4b96295149dcf2fa · SHA256 c5a23f4e8d3c236404acf3a5788dd93537b3582cdf[...]0bc

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:scp.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002

946 B 17 days ago

Suspect

Unknown blob type

ba7368b2ee2bf8043478ac93b02cc67f

MD5 ba7368b2ee2bf8043478ac93b02cc67f · SHA256 ed492e44430151b8a8ad23bb5f5cb097b629fc1645[...]813

1.45 KB 18 days ago

Malicious

Shortcut Link File

d009daaa77ac3ae4a6812e8f1fcd63bb

MD5 d009daaa77ac3ae4a6812e8f1fcd63bb · SHA256 5ab77d640643354800ac7a4a31eb407bcc2b56d70d[...]b4d

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

3.54 KB 18 days ago

Malicious

Shortcut Link File

a2acb6442a05b16d7ca9f2d4280ab1a5

MD5 a2acb6442a05b16d7ca9f2d4280ab1a5 · SHA256 a79d0313100fd2416a45894447311f3c2dd909791c[...]e84

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002

799 B 18 days ago

Malicious

ZIP archive

cd64c4a3ac9bbe299df7cceffc0a17c9

MD5 cd64c4a3ac9bbe299df7cceffc0a17c9 · SHA256 0d04c452ff96b79c20cfa41d2ac09906d6653ad520[...]605

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002

4.65 KB 18 days ago

Malicious

Shortcut Link File

58fbbef22a1f75dd3febf0f810e7d9a8

MD5 58fbbef22a1f75dd3febf0f810e7d9a8 · SHA256 9cdf9119881608c365d9bec3356b06d9ee5bb0ece4[...]c55

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

37.79 KB 20 days ago

Malicious

ZIP archive

4c8ed3f11561a13d7a9b3516ee8c59d6

MD5 4c8ed3f11561a13d7a9b3516ee8c59d6 · SHA256 a11ef5f0f05586bc4798a035cba17d252c94f2f36c[...]c4c

Malicious T1218 T1218.005 MSHTA LNK: Script Execution Execution: PowerShell in LNK T1059.001 T1204.002 PowerShell Batch Command

2.43 KB 20 days ago

Malicious

Shortcut Link File

336ba30bceb4e77bd09db684a4132f79

MD5 336ba30bceb4e77bd09db684a4132f79 · SHA256 36ee3c08ba015e06d74feb1fba658212b842ec0911[...]629

SOS: 0.31 PowerShell Batch Command PowerShell Call WScript.Shell DeObfuscated VBScript T1059.005 Obfuscated T1027C2 https[:]//farea.jp/wp/.well-known/acme[...]e/1.txtC2 https[:]//bvmatqnam.com.vn/js/tt3.txt

2.78 KB 20 days ago

Malicious

ZIP archive

5ab9b307e592a64992bccdfdea8cdd46

MD5 5ab9b307e592a64992bccdfdea8cdd46 · SHA256 c7c19812efc4ea911da10fb8603a338bb8d8ca15e6[...]e50

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001C2 https[:]//shorturl.at/7hM1uC2 https[:]//egrul.nalog.ru

163.46 KB 20 days ago

Suspect

ZIP archive

fe0f81768668a1c281be95dc04b096ba

MD5 fe0f81768668a1c281be95dc04b096ba · SHA256 335993214df1efb9a5fb5fbda79ba272cbab97cffe[...]c52

29.88 KB 20 days ago

Malicious

ZIP archive

14201c51d9407b1b10e1c39eb3a349e4

MD5 14201c51d9407b1b10e1c39eb3a349e4 · SHA256 eaaa4bc79fde2741c391726f90fe393f63e0be136a[...]c79

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001⚠ C2 https[:]//cliff-entire-thinks-once.try[...]vic.png

1.39 MB 24 days ago

Malicious

Shortcut Link File

de7c1d85e7a14305872f168007e7bdd6

MD5 de7c1d85e7a14305872f168007e7bdd6 · SHA256 d318c7d56dd52d00e1b2064335cbfb8974bb00ea68[...]0ea

Malicious Execution: PowerShell in LNK T1059.001 T1204.002 PowerShell Batch Command PowerShell Call T1027 DeObfuscated

7.53 KB 24 days ago

Malicious

Shortcut Link File

3a2370412e4564e7364e48bec5cb4deb

MD5 3a2370412e4564e7364e48bec5cb4deb · SHA256 0cd4604de3284d716488b41fe24760b3375f116651[...]96e

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:conhost.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002

2.18 KB 26 days ago

Malicious

Shortcut Link File

03a76950bee81a350107b6b3a5ff8f94

MD5 03a76950bee81a350107b6b3a5ff8f94 · SHA256 6d41123563020a0d1f723523bdb4501a95277bc745[...]872

Malicious T1218 LNK: Script Execution

1.52 KB 26 days ago

Malicious

Shortcut Link File

ef5bcb768117953cb9d351ae20c44f70

MD5 ef5bcb768117953cb9d351ae20c44f70 · SHA256 4af2f3bd88adee84540c252f7236f82488c3c41203[...]a3d

Malicious T1218 LNK: Script Execution

1.52 KB 26 days ago

Malicious

Shortcut Link File

20989c78b1e51478ebea87d03005095e

MD5 20989c78b1e51478ebea87d03005095e · SHA256 385b70c5cddf2e9fe4a4951dab0dc8dc0eee6271a2[...]49b

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

3.59 KB 27 days ago

Malicious

Shortcut Link File

fc6a98840bbe2ff4e3c818544a0961a7

MD5 fc6a98840bbe2ff4e3c818544a0961a7 · SHA256 041619c550dd329d99cbb1b6f6bd5d3b06fcee2d26[...]0bd

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

3.59 KB 27 days ago

Malicious

Shortcut Link File

75b7e433a16d698e8a0762aec94bde70

MD5 75b7e433a16d698e8a0762aec94bde70 · SHA256 26af0472b17df3c7261b53a25a73f8943386a73600[...]868

Malicious T1218 T1218.005 MSHTA LNK: Script Execution

749 B one month ago

Suspect

Shortcut Link File

61d08dc4890fe6341e0390e6e87e8529

MD5 61d08dc4890fe6341e0390e6e87e8529 · SHA256 613b6569bd8a4cd75ab11ee9682dd690fabfb11d5c[...]034

1.75 KB one month ago

Malicious

Shortcut Link File

1e559d44c840e5204d2f49e181718442

MD5 1e559d44c840e5204d2f49e181718442 · SHA256 867698b09d1780c28a5f2eb751a932521b3e2cbb79[...]7f3

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

2.19 KB one month ago

Malicious

Shortcut Link File

88565f2501520a1af172543249f91745

MD5 88565f2501520a1af172543249f91745 · SHA256 a6fff495c6b4a3b9414d31bbe1058aa204b949c36b[...]635

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 T1059.005

156.71 KB one month ago

Malicious

Shortcut Link File

56fd579bd9e1879a103110453292bdcb

MD5 56fd579bd9e1879a103110453292bdcb · SHA256 4f954c7c6228ca4eb0e6b7c3d5f2d025467996866c[...]f19

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001C2 https[:]//rajug.eu/lime/lemon?du=$p

3.46 KB one month ago

Malicious

Shortcut Link File

782ff295feec8b51f88d84435a6345bc

MD5 782ff295feec8b51f88d84435a6345bc · SHA256 b934750358b6f8cf2814b972387f3463213ab8149c[...]2df

Malicious Execution: PowerShell in LNK T1059.001 T1204.002 PowerShell Batch Command PowerShell Call T1027 DeObfuscated

7.45 KB one month ago

Malicious

Shortcut Link File

f6786ff62fdfdc46cfb84ff7cc2a580a

MD5 f6786ff62fdfdc46cfb84ff7cc2a580a · SHA256 df74f2f8eb8d707411ffb8ee8f9c9fb1881fe1cc38[...]b9d

Malicious Execution: PowerShell in LNK T1059.001 T1204.002 PowerShell Batch Command PowerShell Call T1027 DeObfuscated

7.38 KB one month ago

Suspect

Shortcut Link File

4838a389f78b3f0735f5a01ca9ebcd5d

MD5 4838a389f78b3f0735f5a01ca9ebcd5d · SHA256 1bc02d93c736945c91c62bcc1b985ca6ea05b290f6[...]7f4

2.06 KB one month ago

Malicious

Shortcut Link File

8cf57f185a27f84a284c7850493748de

MD5 8cf57f185a27f84a284c7850493748de · SHA256 523d6d2479a05d5a3c854fe6a76af1156afc05c9a4[...]aa0

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

2.58 KB one month ago

Malicious

Shortcut Link File

7d1462c874ac3adea59fb235e24b4abb

MD5 7d1462c874ac3adea59fb235e24b4abb · SHA256 167557f5a7769c028691cd7bd106a3ef5ae537fe04[...]ec8

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002

3.13 KB one month ago

Malicious

Shortcut Link File

26b3f7856483622397d512ae6bc1eb2e

MD5 26b3f7856483622397d512ae6bc1eb2e · SHA256 6e6d4084c6c2f3035c2fbda4daf4b705a06938d73b[...]d9b

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002

2.17 KB one month ago

Search results