Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 2a54fd93c06bd314fc4d322884cfb038
Sha1 6be26b412285a4ca94e26f877334188c14e076a1
Sha256 5d1b9ee52704e63b9fe58768a6c042eb33a671e31d0aeb2b7ec8279fbb596656
Sha384 fd32620979b3fccb5c252bbba1a483badf97da22a73c3f82ac042135d7edfae698238cf835b7eae4e5b44d6f31feeec2
Sha512 bb405fd605495d5a78afcb43c222857996b4723b7ce912112331f3dfdca1f48a883b71495fa19555af9ce2584c0ef1351659aefb9b98124b2388d52106bd3bce
SSDeep 24:96R64ovPz+voMYAKMcBHF6UwL/yaryduMgmkNn+UaNuUamida+lZVh3Bzo0gRwjo:96R65vb+WAKMcziaMTNn+UkO7HlZVjo1
TLSH B431E91865F8F285E051933DBE845F8A2E0E9003D530D1CB615A035667169041F5B92E
2a54fd93c06bd314fc4d322884cfb038
Malicious
photov_851217915299.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_258789221177.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$zzd4 huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
2a54fd93c06bd314fc4d322884cfb038
Malicious
photov_851217915299.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_258789221177.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
2a54fd93c06bd314fc4d322884cfb038 › photov_851217915299.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$zzd4 huhuhuhuhuhuhuhuhuhuhu
2a54fd93c06bd314fc4d322884cfb038 › photov_851217915299.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙