Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 0f780eb6e67f2acbfaee3c5693ef910d
Sha1 2cdd7b603fd8ed1adf9c5f5b07c0ca7ec9278a14
Sha256 4598791d57616e612bde1395983c7f8e26b0fdef729e31ec0afc5d566c2f5874
Sha384 ff2acc0a6b7977a7e0b5efab279236b8070a38257dc847ee291d9f239d9d68dc00ee216372f77cf8217d562679d1077b
Sha512 9175751ef25b263cb8ba9ec7f7bb9a6289f4593c64292af4b5d67d6e1160e59d6b9ff8e972a7192b928e1574cd76198f4444e74d0684f28166808354776a7518
SSDeep 24:9Lh1CeVZLTKcPFeAfSnxGwx6XxpZTUH2XtScykmSPel4JZ7w+dhCDCQXtFvcIVl:9/LTbPIgicLUH2Xw1kPrloXzv3l
TLSH ED11A5E8184AADA2ED8355327CE27F22A2365E50063163D93B5E529B2F3BC095352489
0f780eb6e67f2acbfaee3c5693ef910d
Malicious
photov_343841063005.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_169286541157.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$pzfrthuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
0f780eb6e67f2acbfaee3c5693ef910d
Malicious
photov_343841063005.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_169286541157.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
0f780eb6e67f2acbfaee3c5693ef910d › photov_343841063005.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$pzfrthuhuhuhuhuhuhuhuhuhuhu
0f780eb6e67f2acbfaee3c5693ef910d › photov_343841063005.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙