Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 014590863899cd939794f0d696a70a80
Sha1 1ca9dc1bb7f77c41a340477b8a6ccb42487bfbf4
Sha256 d9d1e5ea108414535c5c8d6c7ecc30589fee71ff48cd19f1049d60b52b0a26ce
Sha384 32296e0cd8bd3ec0055f85ed192be73aeca79fabb026651a8a1e0d28c1980cb0e9f49779773f3a552b498e42fdc40193
Sha512 d5402c8a6a96acc071282936e4e18cb27bb342b7bac4447c553edfd135fb2a90d778b2fb3959434df9a021055917007a503c3797f388b220bf2941666ce6bb96
SSDeep 24:9yNV5CywRh4vqLtw8tt+zvY/AFsqRQlG4uttNVJubQ4H3ekmkLAxTW0Ds934Y8N8:9UGOwt76jYJURfJqTLmvst7
TLSH 8831C9D1E34EE350F3D7C07F773D6BCC387825691544766DBEBA61486883818D251D4A
014590863899cd939794f0d696a70a80
Malicious
photov_319873801004.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_524906906621.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$s8zpuhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
014590863899cd939794f0d696a70a80
Malicious
photov_319873801004.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_524906906621.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
014590863899cd939794f0d696a70a80 › photov_319873801004.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$s8zpuhuhuhuhuhuhuhuhuhuhuhu
014590863899cd939794f0d696a70a80 › photov_319873801004.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙