Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 0b902b1a40351f252bf835002edd881b
Sha1 a033b1fb4abeaf19ad79279da40cc497a3ba46ec
Sha256 0e643ffb1e4df2f5b281f88543f0e7840f350ac1c81b801be0b2bc2d98dfaa94
Sha384 3795a863fb4346d02a1ef8eb301d01430f2d6c25a578667be51d769b755e40a04acc504d02695d7ab95d94a8cc190845
Sha512 a149802b0d7e5dcb14975a3638fd411b390f9522bed2deee5348313a6e184d18142898c54bd4e7e7e11f1e7cbcc117912c90b448da72c94405b3414015315bfa
SSDeep 24:99LeiKl9OFBqId1JzlKDvG0mSKyOHeISiLUGmpaI:99Lebli4IdjsDv5P2S6UGmj
TLSH D121A768F5D3E672D80FD3B52F252D045301A8B10826417F568C269A3CCEE2C885F285
0b902b1a40351f252bf835002edd881b
Malicious
photov_051923903839.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_849870852317.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$vqh37huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
0b902b1a40351f252bf835002edd881b
Malicious
photov_051923903839.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_849870852317.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
0b902b1a40351f252bf835002edd881b › photov_051923903839.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$vqh37huhuhuhuhuhuhuhuhuhuhu
0b902b1a40351f252bf835002edd881b › photov_051923903839.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙