Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 1a674d209c6d595b04b607f82a4a1656
Sha1 373777cdbc2a485a68c113ec0097077858f68db2
Sha256 81cf71ed23a3dd5c6bc16d5ef0ddd73ed26259efd9df76acdcdcd1d022498e4a
Sha384 41a2ee86a6ccbb23fd49b753873a3172d7b5afa78cbfe4a86b603b0ac00da20ca505ceb2ef3e1473db8f37b89e6b56c8
Sha512 87461b94082e8d1d91b659c828a68143d50c5b28f45fc938b7bb7a9de00a66d99406fb32decb528fb7f52cbe31c18daca149ffa6a1a04ef5503a3a97d95108bd
SSDeep 24:9oVu6fZzKkWTPrUIFTiKKoQLuCm7REd5g2mHmkusKZtubjeYayvEEmwyTGUV93q:9oJ2lT1hQLFmdEd5g3HTusKZIbxEEmwz
TLSH 8631C730C68647A3F0AB5831ECAA0D515222A2A1216E8A668D35E5D23EB5F91A3C28D4
1a674d209c6d595b04b607f82a4a1656
Malicious
photov_754020956855.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_978638260765.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$anbv huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1a674d209c6d595b04b607f82a4a1656
Malicious
photov_754020956855.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_978638260765.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
1a674d209c6d595b04b607f82a4a1656 › photov_754020956855.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$anbv huhuhuhuhuhuhuhuhuhuhu
1a674d209c6d595b04b607f82a4a1656 › photov_754020956855.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙