Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 147113be2b20663c4975005f8f6b333c
Sha1 ed7ca7fddc960fa6d68078d9d8f0965d6d51439d
Sha256 099eff58b36bb1292068cad4e1d45d2d70308423001b72f49603f9d46136fc48
Sha384 7fd25fe6e98a8a9744a8fa32da5b532bc2d322948bea866560ea54857de3c31828ae2f035af1ece0b6f00a4536e7861e
Sha512 d1f25df2de08758bf83e48bc1006b1dc0cedd146610fe508a2530e2f4e8c72467f90b6f22e487d66f47892fcdf5b51827d04b43370995564dab43ed2e59377da
SSDeep 24:92qqujHBK7RVWCjyB++AhzVD41mS+7hT+FV8uoax6VLobINFLOw:92qbjHBK7RVLjm5AXiPEB+FroaQ9osT
TLSH 5521DAD0D002DFE1D8A1BEB3F67087292394137371211860B80A79623DC791E7FBE188
147113be2b20663c4975005f8f6b333c
Malicious
photov_278877220655.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_690145374654.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$zouvphuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
147113be2b20663c4975005f8f6b333c
Malicious
photov_278877220655.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_690145374654.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
147113be2b20663c4975005f8f6b333c › photov_278877220655.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$zouvphuhuhuhuhuhuhuhuhuhuhu
147113be2b20663c4975005f8f6b333c › photov_278877220655.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙