Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 109378628af8330a3ae8ac6227a06e13
Sha1 8ba26e8fb21b1e190ec1361551a5cad141f689c9
Sha256 d7e3a1971ce392b9904da4f805e7cddd7a5c9c7e41f2bdeee1db4bd9d00f3a59
Sha384 d44e9c46a547eac5aefab83187a7b76c3d4a882ca8d7c8ef94c8e9cfd8e57c77303e568459816a53f992bcd63a632acf
Sha512 a056fab5ac004ec93aefe48de13a8c0970617c86560ee5b1869b06259304327bbc5155567d9c92aae67e37ddacb8a6fd7d0b817d6841bd2cd67032572ef2dd04
SSDeep 24:9IPmg1KgU4LYee9ek/Qdxp0sYqvSmSAcJJxLHf57v:9INKaLxe9ek/Qdz0BPAuJfB
TLSH 5821B638A4FC9D92CF4EE03BBD059102937809316D0E61C10BF4538AA80F3C872D4D50
109378628af8330a3ae8ac6227a06e13
Malicious
photov_277451512669.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_277014179875.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$y1mgthuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
109378628af8330a3ae8ac6227a06e13
Malicious
photov_277451512669.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_277014179875.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
109378628af8330a3ae8ac6227a06e13 › photov_277451512669.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$y1mgthuhuhuhuhuhuhuhuhuhuhu
109378628af8330a3ae8ac6227a06e13 › photov_277451512669.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙