Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 1a678f5df943e60d621b53de7718a4af
Sha1 eb737705bd072986dfd3ffbd2bc1187ca9705b37
Sha256 39cfdc496ae6958c629d30882cdd83ea93db4aa98a830c7410da849c048183a2
Sha384 08fae82f0b33f1462bb5d246819500c611efa9ee9d9f87e280ff455bbab1c53b059fd634d71b007737e39ebd6d22c742
Sha512 77421e1227329c0e93cca19b0d2b906cab0ff223ba259ce9908acdcb5899796fcc8ccbb820e461c0b2b50d4f5507dc1e9013250b9ed4be2664572f2ebcfa88c7
SSDeep 24:9TSliwEzi8qek494/82GlSYvD55Ys7mSI+xB8rU93rZ+BV501VsYsN:9O9d29cRAl37PI+yUFABRN
TLSH AB21B720C00C8A70DEA3A375143503CC686232D8935825BA9378BA563FCEF13E6405C8
1a678f5df943e60d621b53de7718a4af
Malicious
photov_677513852955.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_900344250576.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$s5bsphuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1a678f5df943e60d621b53de7718a4af
Malicious
photov_677513852955.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_900344250576.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
1a678f5df943e60d621b53de7718a4af › photov_677513852955.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$s5bsphuhuhuhuhuhuhuhuhuhuhu
1a678f5df943e60d621b53de7718a4af › photov_677513852955.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙