Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 0c4c60720ab0c141493b0e267cae4f4b
Sha1 b454c4e9dd7284fccba7622c8b7cb4733f0a1b86
Sha256 734a3c39773ae8dab54e21d2d3d5d14e57601f0f97e69601d2e2782cd2c1ec3b
Sha384 3720b9f78b98f04f375b2cf97b245872fdf91f6eab95dae0d2407a6f28c30535bc0c38c3de4c77a504c7c92b3c3a575f
Sha512 51d4bacfd86e91af8b2933ae870d079fb4ba50c389503c0ea9c5066ee5730dddfe797ae3794587b79128d3413ca5e98eddeec8bd30d97a97726d5f52a79e7468
SSDeep 24:9q+3in/UeEtCiPUlAfYSgY+xeUJH9O23mkWt/5cpeYV8MXPvb+u:9qkulEzPqU/AJT3TUcpeYVl/Su
TLSH 7021B728D32D78D8D8E320B4BE6B4FD85E05C0588D234A3B3363A858BE79B44A2640D9
0c4c60720ab0c141493b0e267cae4f4b
Malicious
photov_210125597977.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_453899495190.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$vtjn huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
0c4c60720ab0c141493b0e267cae4f4b
Malicious
photov_210125597977.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_453899495190.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
0c4c60720ab0c141493b0e267cae4f4b › photov_210125597977.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$vtjn huhuhuhuhuhuhuhuhuhuhu
0c4c60720ab0c141493b0e267cae4f4b › photov_210125597977.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙