Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 0d0c29da95a0fe3a44c64fc16ae35b72
Sha1 4518ccc8c15167664f202bba261e437da5f2c884
Sha256 1166690e51e60e83618b14032144a17884c916b06c13476f7a7939ef80f722e5
Sha384 bb4959c94a899d8e2d5d53140bf851ded9eec255e72fe36caaced5da375bdc5212e9c874065552dee0909cf69c814ce3
Sha512 5ea61ce77490fb2081fc372535c8f28c624722925b4afedf3bbf3102eabe7f6bb2f83b7f04ff073ec50815e6cef24ef7aadfa9c50a32bf5a4f9bcd0adfeda158
SSDeep 24:9EDVkXNlO5sPoaiNk7wwwMG6ARZoC/ZYA81EZB/N2sgmSpJQtnnY77NrGg3w2Vg2:9UyXaqjjswwMtAToC/ZYb4asgPzUY7ZF
TLSH 7F11A579D81FFC50CF8B0339F2213D192929A1190822E1DF26F3B15928DADE893401F5
0d0c29da95a0fe3a44c64fc16ae35b72
Malicious
photov_922150137128.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_491447839342.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$txp78huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
0d0c29da95a0fe3a44c64fc16ae35b72
Malicious
photov_922150137128.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_491447839342.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
0d0c29da95a0fe3a44c64fc16ae35b72 › photov_922150137128.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$txp78huhuhuhuhuhuhuhuhuhuhu
0d0c29da95a0fe3a44c64fc16ae35b72 › photov_922150137128.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙