Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 0aa4106d38302f055ccc67d8f09df260
Sha1 4c92e0ecc2ecf3ad4759f59576ef761c753878b7
Sha256 63e0e543dc693406dcf5319974da6a0ec1d200e756b54c6d4736ff1021742c74
Sha384 5e38ce40a1e8afad72718570d7bad493394b0668dffb5499a777583ae54de60c0caa3c9923c6d7a839fdd1c0caf04647
Sha512 18e9af9d4d2b89b57d8d17140f9f7558c9b82d4e9ea25bf2ebdd3e694f318f9e30968b393347088dec6bba43e598922cade8c30c3536a0e3aabc4e25cf63bcd2
SSDeep 24:9XPdTZqtSZQ+N8tzAaDw3CI8c3z2jNjyuYZmSefJWhGY766kIdBYwGPmryjYa:9XxzZaO3CIBz2ZmuEPKcGY7rlTdGjjL
TLSH 5E219590F0B84C72F5AE663B4824FE94920426300959B86B27C9329D7F64EFC27C8785
0aa4106d38302f055ccc67d8f09df260
Malicious
photov_985193696220.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_443539302622.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$gu8dghuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
0aa4106d38302f055ccc67d8f09df260
Malicious
photov_985193696220.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_443539302622.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
0aa4106d38302f055ccc67d8f09df260 › photov_985193696220.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$gu8dghuhuhuhuhuhuhuhuhuhuhu
0aa4106d38302f055ccc67d8f09df260 › photov_985193696220.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙