Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 2150cf7fe14b0ae685ffe9f876452e43
Sha1 ddaf857f7df6ec8f01a525a9e6a6267ae786ab89
Sha256 c28abda35a629a5684d5ce30e23ef63c2cf90ad85af21202305076569229d4c3
Sha384 e700e2344df360c7bff57647667cfe255ee82c28ee4c28664663a03645b1b6522e47da3191bf211b7e85616930eaa146
Sha512 b98332b8c9b166c43b1f1b91c08460cea34f1696000d274a7c891a134ea7258bbe60f76505b98a87f6af5595f35a7c1002ee769c71f3dcbecb27b3838485721a
SSDeep 24:98LBP+qDFuOgWuGJ7Uw+2A8Kg9YnPmSzhth6sK+0WP66skl:9YuOfuGJV+KKgWPPlbikl
TLSH F7114200187E8720FE47923E2C1089CA86964C5AC051A1813ACD69B36D9BBD487030D9
2150cf7fe14b0ae685ffe9f876452e43
Malicious
photov_353982718372.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_978933124530.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$e6eeehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
2150cf7fe14b0ae685ffe9f876452e43
Malicious
photov_353982718372.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_978933124530.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
2150cf7fe14b0ae685ffe9f876452e43 › photov_353982718372.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$e6eeehuhuhuhuhuhuhuhuhuhuhu
2150cf7fe14b0ae685ffe9f876452e43 › photov_353982718372.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙