Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 1ed2f3cb19cd580e22f96d59b4097592
Sha1 f29ff5a719ff836eabf350ba6bd9d3b0f390167a
Sha256 cf4542d34db7c9156ae66d879818783058d3bb5bd6c4b004c6f7d4cbcec8e707
Sha384 5642e378933ed9832b342a9442515cd4296bf6cdf8eacff1af8dea039e95740d848c24161a2f77c212d7fcf6171dac44
Sha512 3916294450819792310381a0d99c0e87ac930e3495d325f990144456da77379287f66d9312f0d73a34400d849ce1568307c9f20e390bc13cb7703f92ef349ca1
SSDeep 24:9UrO9G2S9O5KbjYjOnuySJQo1boRVR8fpB3O57N9Mmk8RA4P/OINoVJ6Mbqav1nG:9Uy9GVOEOnQ6bXpwtN9MT8R3ZoVJ6Mb2
TLSH 3021D590829C86ADC01FD571F821FC05213908AC501FC7E7927AE5B15F17F9A23986E4
1ed2f3cb19cd580e22f96d59b4097592
Malicious
photov_709235722792.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_941274307422.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$osp8yhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1ed2f3cb19cd580e22f96d59b4097592
Malicious
photov_709235722792.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_941274307422.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
1ed2f3cb19cd580e22f96d59b4097592 › photov_709235722792.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$osp8yhuhuhuhuhuhuhuhuhuhuhu
1ed2f3cb19cd580e22f96d59b4097592 › photov_709235722792.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙