Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 0d5d7648efd4283fdd61bc0139dd344f
Sha1 bbf1e7212e4fd52de01f931ffdb2367970ac0afb
Sha256 c957d8c11ebeccf2ffaf01b2a80a809b90ccfe1e0b068a50b18d0e69c82a8d77
Sha384 5e08bc71c62a7a2c678ae6a3ba7d02932961f0379008152dbd10e94de1e33c32fdc0ad9acfcd91054123d7035ddefbec
Sha512 ca6b9f011de383e416abdb5539b6f1472fe78dacf47e3b3dd8bbf4902058206e262d7b5de3c5f4c08a9b8b419cbba1ac9dbb23218e15109864eacca3a3b28403
SSDeep 24:9EzSN6i5Gl+fRE8oQmdY1byoT0yLy6+MXjWd7mSorhGY7RFVXTMSbWnWe1+OTwF5:9Eu15GYfpNm+ZyO02jWd7PkGY7RDAjsx
TLSH C121849CC9ACFB89C0CB9C35BD18D54D0044A1ADE01272E39698567AEF69F8E17831F4
0d5d7648efd4283fdd61bc0139dd344f
Malicious
photov_173624634575.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_833916439612.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$yfp1mhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
0d5d7648efd4283fdd61bc0139dd344f
Malicious
photov_173624634575.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_833916439612.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
0d5d7648efd4283fdd61bc0139dd344f › photov_173624634575.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$yfp1mhuhuhuhuhuhuhuhuhuhuhu
0d5d7648efd4283fdd61bc0139dd344f › photov_173624634575.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙