Managed XDR

datev-rechnung-20nr.-2021412122025.pdf.lnk — malware analysis report

File info

Filename
datev-rechnung-20nr.-2021412122025.pdf.lnk
File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=11, Archive, ctime=Wed Jul 9 17:34:51 2025, mtime=Wed Jul 9 17:34:51 2025, atime=Wed Jul 9 17:34:51 2025, length=335872, window=hidenormalshowminimized
File size
1.4 KB
First seen
Last seen

Environment

win7/x64 en

Hashes

SHA1
1961fe18ac5e07755002230abaa2482a113b2159
SHA256
86b6a93faee2f1b49822d592f712410af77784dc6f10215a37459ed10400fced
MD5
e4c7d501d07297db5df9c6c6bb008c76

Signatures

Execution

T1204 suspicious_lnk: LNK file with suspicious content
T1059.001 url_cmdline: Cmdline of process contains URL
T1059.003 url_cmdline: Cmdline of process contains URL

Persistence

T1197 bitsadmin_download: Downloads a file using bitsadmin

Defense Evasion

T1197 bitsadmin_download: Downloads a file using bitsadmin
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)

Discovery

T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)

Command and Control

T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp

Other

unexpected_exception: Unexpected exception
no_graphical_activity: No graphic activity
creates_suspended_process: Creates suspended process
message_box: Displays a message
suricata_alert: Malicious traffic detected
yara_rules: Static rules