Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 187e736cf7b43284a7d566df269322b4
Sha1 b178418da67f0419ac82acea9ca5be229296a62b
Sha256 680c8f5840e1711d77a5b13cd2f0901e4866f770ce2778110c48e39ad93c4cf4
Sha384 f48c5c817914f0f569aade684132d21e99951b09ef88a2cf79a7d8821c814eeb9821a4a1a1614800c444082769b1e519
Sha512 0beed878e5dd4506e4461c6466f0a056ae216da1fdd59ec2444c9520a4d60a75dadd4b9b69aee625074f0d392eaf165e3e60d45855fe13af3c5de7e92f9963a0
SSDeep 24:9m6GL6J5fzR/Tat7GWe8P2FQVr4ZmknetubjeYleqGZlNwX:9CCNzFTMqEP8QV8ZTneIbp3OwX
TLSH 1F21C82488C984C9D1EF663434594B5F0714695599045AC6DBAAE805344B9C2F70BCE0
187e736cf7b43284a7d566df269322b4
Malicious
photov_501789132308.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_351111753290.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$nguy huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
187e736cf7b43284a7d566df269322b4
Malicious
photov_501789132308.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_351111753290.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
187e736cf7b43284a7d566df269322b4 › photov_501789132308.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$nguy huhuhuhuhuhuhuhuhuhuhu
187e736cf7b43284a7d566df269322b4 › photov_501789132308.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙