Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 212271969d69ed5db3df093d360a7390
Sha1 6382e59ce1f55efde3f3619a188eaf3745249ce9
Sha256 2652886be2ebb8b2ee6789bac6080219842bd0f9274cf969cd378b85fec8b8f7
Sha384 24cab0ce95ae865199b419be33a4785b886ed2dfd94507689d7f9a6c5ae0226475b5761c0dcfd1f1e128f1a232d2261d
Sha512 6eff91423f8be2cbfd7057ca7303191e8ca6e8ce5d5f3a0f692ad954f2d050a6b017b3b855defc4486dd29be845cd90c6503172c94392db3bb81287fd093fc40
SSDeep 24:9TU9hJvM+htJqfntB6do0xEhbQmSXb4/NVc0oKbzPK6//:9A9hJvMMtAfntB6do0xEKPXoK4bP//
TLSH 6621B464F494C84DC693C73B318A490C133A36C09644E87B9ABA5DF179C6B0C4B4BB74
212271969d69ed5db3df093d360a7390
Malicious
photov_467272082686.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_218718720554.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$ri4q7huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
212271969d69ed5db3df093d360a7390
Malicious
photov_467272082686.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_218718720554.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
212271969d69ed5db3df093d360a7390 › photov_467272082686.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$ri4q7huhuhuhuhuhuhuhuhuhuhu
212271969d69ed5db3df093d360a7390 › photov_467272082686.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙