Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 295a727bb11648153680ab80fbf1eccf
Sha1 4b6abb6f1b9b39d5fd5850e3312506f7dd253cbc
Sha256 4a21cbcd057bfbdc797aadc72a13b329a17cb9ef2831493017c643f5ade4fdf4
Sha384 a9e062fce7898ee81eaabbf8c6ac531c8d3f2f08b474be38977e1f48de7528df069d1a9bdf6fe156661e0034fa050152
Sha512 6c0be71b1f38c21095c8e8427bad2245cf07b266481a8452bd533aaeefe35918b95cb5ccccda68108fd6a2c11b0e1c07b301a1a076fec280821613fb64eb6547
SSDeep 24:9eGw7GHr+FCgKbmLvTTs/G5D53mPmSyXJJxwcL5bt4Btn:9eGw7ybmLrz2PPGvLpSBtn
TLSH 6C1179E694868DC6CF09CD727592A18A5134765086111076575577D2AF33C4CF345CB7
295a727bb11648153680ab80fbf1eccf
Malicious
photov_702577130689.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_932531098805.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$h_otmhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
295a727bb11648153680ab80fbf1eccf
Malicious
photov_702577130689.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_932531098805.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
295a727bb11648153680ab80fbf1eccf › photov_702577130689.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$h_otmhuhuhuhuhuhuhuhuhuhuhu
295a727bb11648153680ab80fbf1eccf › photov_702577130689.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙