Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 07eeaabb9fae8ba2205086f3c98c6feb
Sha1 6e061c02b74313d90dd9354363ba0e3d73854dd8
Sha256 e9afef6f4daf292bf86921d6782c92bfce933198c1cd8b99395dff67a3129cd4
Sha384 6e87002e33de0ae4192b935b2984a5a210d20f52e1b571c425a5bbcbd25873512de1e2eb9b3d600ea5532f94981414d8
Sha512 98547d4b72a7ecbc2f219bc8a3d83f882407728a5b092ca218530dc9a5a022488e8af58f2aa3b1940625fa4d00232ca48c9f45795bb77c86da72d2ad55e471ce
SSDeep 24:9Mcn/ysOVU5/oUFwbZha4YoUqbg8FXwkmSY0h6acaSJAnJ0CbnST6ck/UXT3:9Mcn/ysO+AUSsoUMXFPYQvvSGJ/bnbcL
TLSH C721EAF09F13AD86C0C6E33348FAED804965A3219A94473A425F65FD3750DC4A21E5C8
07eeaabb9fae8ba2205086f3c98c6feb
Malicious
photov_490019686817.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_785324775231.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$id1b4huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
07eeaabb9fae8ba2205086f3c98c6feb
Malicious
photov_490019686817.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_785324775231.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
07eeaabb9fae8ba2205086f3c98c6feb › photov_490019686817.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$id1b4huhuhuhuhuhuhuhuhuhuhu
07eeaabb9fae8ba2205086f3c98c6feb › photov_490019686817.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙