Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 3108f64c1b7fa72eb94f93555a75c0bd
Sha1 f07707d07bab2e0061f0fc2186b2fa8adec07ed7
Sha256 b49c56f3e4d37b9904593bd8e45a10ddc07b8122c2f789bed2b980b39128162d
Sha384 2d0d6e1a9744015f6369e7739f138838a8dfaf37fbd5b0b94c823bf4a29564c9c106b653c13282a5ab5f385471332d00
Sha512 eb651c6e4c88406a44f50840fbebb1e09016260fda83188eb831c6a0be7c1cd28a3a9517ed1a3bd856da8346615449bbe1b7f22536d385e82510391256b08455
SSDeep 24:9w9o9EKjQ2KE98nJ53DL74MlcgmSP064mhHcN2A9o9eeXCIlcH:9INK8EenJVcgPsvgcH
TLSH E311757485EFE830DF06D936BB00B131D2657641522AD122276EE8863D9D8C39B039C5
3108f64c1b7fa72eb94f93555a75c0bd
Malicious
photov_939862795057.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_254031731749.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$xf2hxhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
3108f64c1b7fa72eb94f93555a75c0bd
Malicious
photov_939862795057.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_254031731749.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
3108f64c1b7fa72eb94f93555a75c0bd › photov_939862795057.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$xf2hxhuhuhuhuhuhuhuhuhuhuhu
3108f64c1b7fa72eb94f93555a75c0bd › photov_939862795057.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙