Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 1a590d295e0a5ca5cf13a84952180009
Sha1 7388e787be421c9d55cf4788c63a756122b2693a
Sha256 91bcb7f348e9024f9eb372143afdc7adabf4b53cc4b516e0dfde5137441ae35f
Sha384 8c0ad0afacb93d14693ce03640e618cb82eaf201ea38467ffcfc7a42a3c2cc0726c51d67cabb856a0aaf9bf7e1cced5d
Sha512 0595acbba5d3a877d51b05cf714e1661eb28374a14a8e77337f70f75ee27255ec4f6123d13c908e7f130b127cdf83698ea6331464254341ad8a9a2b3f3ea339f
SSDeep 24:9idrUqkLFZaxJ3Qm5gXr1EmBGIxncwZGGSVmSXS4mJfJkirpLPvxBtidIbt:9itUZ3av3QCDH3VPXlixPvf8Sp
TLSH 28219680C51FEB46C61D893E1C9C4F4F1146088A93EA7A77A33571B63D17D996F03A88
1a590d295e0a5ca5cf13a84952180009
Malicious
photov_635446815627.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_235423538089.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$tjvnrhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1a590d295e0a5ca5cf13a84952180009
Malicious
photov_635446815627.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_235423538089.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
1a590d295e0a5ca5cf13a84952180009 › photov_635446815627.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$tjvnrhuhuhuhuhuhuhuhuhuhuhu
1a590d295e0a5ca5cf13a84952180009 › photov_635446815627.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙