Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 2311e517cd16ad4e7921f04f2805f0c9
Sha1 d7eaebc2a1d2c670b7724837ae9579b196f1d75f
Sha256 244f99aee7d8cc63cca05e29ad19f03043165a8bde6ad4f21ec88cc6bafa858a
Sha384 88fc413b95bbb3a65d67460f8e3363af0eb83483deca7bb4bf40659bc48f22c3ccea9866ab181d79a2b929e3874f94bf
Sha512 cb81989327409109f679894bb361401a38b01b5a89ac549aeaed7d4615b9e2e0cc8b8def6380d514ee0935cee256f1300a912f052c5f966890d7e017217460ac
SSDeep 24:9/tuhHuyxWBOT3jlrppBYTQj5i8EJBIt/S4jmk3KbW3sW8xhJi37Wk1t9ye4T:9/t8HI0ppAQj5xEJuxBTz1u67W+tY
TLSH D631C65AAF95C172D14FECF9EC0F1216034408C51C45E3F792AA514618CA8E4AF038B4
2311e517cd16ad4e7921f04f2805f0c9
Malicious
photov_351499307841.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_822403673843.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$f2vghhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
2311e517cd16ad4e7921f04f2805f0c9
Malicious
photov_351499307841.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_822403673843.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
2311e517cd16ad4e7921f04f2805f0c9 › photov_351499307841.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$f2vghhuhuhuhuhuhuhuhuhuhuhu
2311e517cd16ad4e7921f04f2805f0c9 › photov_351499307841.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙