Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 0a21125e5d8fd1c3711767f667914711
Sha1 d5b788cf8883dd4ea7335d2888dbbea05cd726e4
Sha256 42c47ea407dc3c6e5f9b0daccc3c493e6a14fb65f9d4040e76884e4e64d052fd
Sha384 7d8fc37cb673ac486ee1965693069ebd55ff71aa1305b8eb2eda03871ee48ae48ea0d51f5389f8b9e5c240d2a3d99293
Sha512 b3ec4ca8fd056daeeb80092ee6fa571f55645d73db7ada2347c8e45de2b3479582fcd2e9fbf9709b1a006456872132fbc74044a1e2e23ebe59ed7de66a3a8acd
SSDeep 24:9DiTD0Rlb/TB1Av7y/7mSfaoJlLuSQli3uD3Ni:9KalnA07PDXHQE+7Ni
TLSH 6911728CDBBE5626FC37C23139C8A2969A31B8D8536513133338A0EB1CA04D8D788F57
0a21125e5d8fd1c3711767f667914711
Malicious
photov_757156596810.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_882782465259.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$yz6emhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
0a21125e5d8fd1c3711767f667914711
Malicious
photov_757156596810.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_882782465259.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
0a21125e5d8fd1c3711767f667914711 › photov_757156596810.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$yz6emhuhuhuhuhuhuhuhuhuhuhu
0a21125e5d8fd1c3711767f667914711 › photov_757156596810.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙