Managed XDR

1.pdf.lnk — malware analysis report

File info

Filename
1.pdf.lnk
File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Thu Oct 2 00:41:18 2025, mtime=Thu Oct 16 05:52:33 2025, atime=Thu Oct 2 00:41:18 2025, length=454656, window=hide
File size
1.8 KB
First seen
Last seen

Environment

w10/x86 en

Hashes

SHA1
592ee69e519d55ea558a7199d9ca30a36068957e
SHA256
fec8646fe40c27b3e61b1accc7105bcdb8e64b3a24da22342e0ddb7e0e002d0b
MD5
57f4b1acbcfe1133579b17459569090c

Signatures

Execution

T1059.001 suspicious_powershell: Creates suspicious powershell process
T1059.001 suspicious_process: Spawns a suspicious process

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
no_graphical_activity: No graphic activity
creates_suspended_process: Creates suspended process
suspicious_network_port: Performs TCP or UDP request to non-standard port
writes_data: Writes big amount of data to disk