Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 0f2dccaafd156f81ff472c2b0cb49575
Sha1 c63f3c347f03c6770cae74b78814a99e5635b2a9
Sha256 76441cd634d32a17b46b11ecb0eb850d932b274e395cb4c7a12a3683fd9fae07
Sha384 4ad3344ca6dd3a235c9d68ff39d4dfead3791b5e066e4f57b4eda97db52a273a529c000965c2d60d77cc6875c7aa069b
Sha512 332beceae9663dc7b0c2cd56db50774ae919a5e2cc77ed74a2310400c1040c6f6e3185085ab939c8a7e121711a0b9d9e45af65153d8eaff4d11a0a3192e93d59
SSDeep 24:9r7JN5t7gEGttwwEE4ksMjAJy6mSZ5+xB8XC7tupf+v1V751b1d//:9rj/gEAtFJTAJy6PZ5+rU49V3bf//
TLSH 0921B4F4D0D552B3C81BC039BA83EB5C00A710A0EA801AD77629BC463DE7AD73F95192
0f2dccaafd156f81ff472c2b0cb49575
Malicious
photov_249215723277.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_920173510077.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$ixrpehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
0f2dccaafd156f81ff472c2b0cb49575
Malicious
photov_249215723277.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_920173510077.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
0f2dccaafd156f81ff472c2b0cb49575 › photov_249215723277.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$ixrpehuhuhuhuhuhuhuhuhuhuhu
0f2dccaafd156f81ff472c2b0cb49575 › photov_249215723277.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙