Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 194bea0f4e6e187bc765a4a427b22e07
Sha1 267931c2ad6602107c60e6b73b62f2f0bda89f19
Sha256 57a855d9f0af4f98e71bfeeafe729631b13be2b8fea657b5e38341a980efdb9f
Sha384 52f82ca8b9aed215751f0b7be86593b3fa4fcdc18fdfdd494edbae8590075571c3b81ed661f165e01a106800ccaf94be
Sha512 8c95ed5264888029009af93370c0e5dd195eadf2463524fb30c03859649d4070e1081e28498aff83f21cc4f68ac39cbcd0d7f9b6469defe3c6080f81fa47c70a
SSDeep 24:98QtJ+9eED3IV14Siuq82H99Se19H0Hlwcmkis+UaNuUamqXzp4FQVbwKh:91tJMTo14Sid82dse1J0HHTis+UkOVzn
TLSH EF21954CC76D9A53DB2796B7BC450D4A18284A3380969AB22D6261D21FA714B963CCA8
194bea0f4e6e187bc765a4a427b22e07
Malicious
photov_482676409233.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_057623241188.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$xwycxhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
194bea0f4e6e187bc765a4a427b22e07
Malicious
photov_482676409233.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_057623241188.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
194bea0f4e6e187bc765a4a427b22e07 › photov_482676409233.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$xwycxhuhuhuhuhuhuhuhuhuhuhu
194bea0f4e6e187bc765a4a427b22e07 › photov_482676409233.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙