Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 2832ce5aad9cb13c88c777457e2ee056
Sha1 74c14dfcc37fdb9f1f6f1a75ea6034e9c3b44173
Sha256 dcc58cc3d0ab2f4c441e84c10e5fab7a65b4a679281aba18681fbd312b32f1b0
Sha384 632790c3dbaa486c8a71a128addae0173f6879a8469fb4f9ecbf36df9da35efed6ac99dc8613480ac965897be0195988
Sha512 f4b865317a10b14c1178bdb7b703c626bb0ec02115fe7d732d37915a8ebe11d4bb1419e78721c085172485952599cf9be8d03313b2242f8b7adb170f8825a810
SSDeep 24:94vuyP0Wxo1G9SwHJ3KADyOYF6/3B1KDBArmkm+UaNuUamlhJO5y1SuX:90uyP6c8wHwA2OYF6/x0GrTm+UkOEhJD
TLSH 672186409AD4D230DD27F7313E54A7D729B1A33D2085625615CD7391BB879B21700FB9
2832ce5aad9cb13c88c777457e2ee056
Malicious
photov_432311984716.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_831272038841.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$g4q8 huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
2832ce5aad9cb13c88c777457e2ee056
Malicious
photov_432311984716.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_831272038841.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
2832ce5aad9cb13c88c777457e2ee056 › photov_432311984716.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$g4q8 huhuhuhuhuhuhuhuhuhuhu
2832ce5aad9cb13c88c777457e2ee056 › photov_432311984716.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙