Extracted

• • Target
    image.png.lnk
  • Size 2KB
  • SHA256 0e2b29973fbce6a60ac749fc53d6dd4d5331631826f57509ededeade157df35a
  • MD5 d9bbb834e4441fc01705517a712edcae
  • SHA1 b15a6cf3b697c1e9066bcf09bfefe1fb5d875fe6
  • SHA512 c5c87e908d48e21d2c445e681664fcdbc9f07d52e45879ee9b32f866747cdba40c791fcc89447cb64afe1551446b8e9e0ed6da99ddbf6323e2cc1a27ded3a0cd
  • TLSH
    T18751EB1427D90624C7B28E77B8B6A2859E67F813F6618A2D10C0838D9C86A40EC21F3B
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion
  behavioral1behavioral2