8eb6a4a4f4db043087c58cc976a741e23e1de05c2f5f8090e376fdcdb47c4cc6

Analysis

user interaction
yes
max time kernel
898s
max time network
473s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/10/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payload/Angry Birds.app/Angry Birds
Size 12.9MB
Sample261003-w31htsvbmg
SHA256 8eb6a4a4f4db043087c58cc976a741e23e1de05c2f5f8090e376fdcdb47c4cc6
MD5 2f4c6e5ef4bafac190a152d02f25ab9d
SHA1 4a3a1441d26596b3ab42aa3b725c891da3a8df7e
SHA512 1d11099b726e91241eee63ea3f4dcbc2ed05e9f2f0b02198f435a76783da613c45b51ef4b15474d2c753f42d1a73f7ffb4013877ce402e100f5dba709482522d
SSDEEP 98304:saa6zqgOfgqprUe2zBGBNDdxHZFtcVV/sJqvNHawMuoUv/ut6USy:PznOfgqpFsBGHrJJqvowcC
TLSH
T1E6D69EBBC7882893DB4F63FA824E070DC621E783AA1192D75525848F7FD62249F1BF45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
788	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Payload\Angry Birds.app\Angry Birds"
1⤵
- Executes a command shell one-liner
PID:788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads