photov_194689927276.zip
Obfuscated PowerShell LNK dropper
LNK decodes a remote script loaderLNK converts BigInt into base-256 bytes
SHA-25679e58c65c58dcec7bc58c988399dcb096832af423d8a4f55d9fddd24f06b420b
MaleculeO₄(AsCXeEr)H₂(CmPo₃)MdTh
Evidence
⋯3 more rows
0x30ddb5da01847024000000000001000000.....p$.........
0x40000000000000000000000000b5012f00............../.
0x5063002000200070006f00770065007200c. . .p.o.w.e.r.
0x607300680065006c006c00200020002000s.h.e.l.l. . . .
0x702d006300200022002400690062006900-.c. .".$.i.b.i.
0x8039005f007700640077003d00370032009._.w.d.w.=.7.2.
0x903b00240065006c0072006f0068007400;.$.e.l.r.o.h.t.
0xa0350079003d0033003b002400740063005.y.=.3.;.$.t.c.
0xb039003600770061003d00370038003b009.6.w.a.=.7.8.;.
0xc02400760072003600730064006e006500$.v.r.6.s.d.n.e.
0xd06500370034003d005b00620069006700e.7.4.=.[.b.i.g.
0xe069006e0074005d003a003a0050006100i.n.t.].:.:.P.a.
0xf072007300650028002700310030003300r.s.e.(.'.1.0.3.
0x100380033003700300038003200360031008.3.7.0.8.2.6.1.
0x110350036003900370039003000340036005.6.9.7.9.0.4.6.
0x120370038003500350034003400350037007.8.5.5.4.4.5.7.
⋯15 more rows
⋯3 more rows
0x3b0290029002900220014030000010000a0).).).".........
0x3c025434f4d535045432500000000000000%COMSPEC%.......
0x3d000000000000000000000000000000000................
⋯7 more rows
⋯3 more rows
0x4b400000000000000000000000000000000................
0x4c4250043004f004d005300500045004300%.C.O.M.S.P.E.C.
0x4d425000000000000000000000000000000%...............
⋯7 more rows
⋯3 more rows
0x3e00000000000000000000000000001600................
0x4e43003a005c0055007300650072007300C.:.\.U.s.e.r.s.
0x5e5c005000750062006c00690063005c00\.P.u.b.l.i.c.\.
0x6e56006900640065006f00730014030000V.i.d.e.o.s.....
⋯7 more rows
No evidence locations were recorded for this file. Raw result