Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 3351888ae9c8a26ed6f8196217120fb5
Sha1 41293510c3fb55e11008d53073574e79fcb6d4a5
Sha256 3aefeb77d9d51f85a2637c01e6bcfc74e9469a7bdf36fb908a5504e9cbdda7d8
Sha384 29b1949a533a9243abc4a507579e159e426888c27d4933f4d99f0211fc7b351115ce998199453a26608a1e6fa464789a
Sha512 f78a047d00994caf51a3d07ddac7d5fc0d68289660bfc76eac4faaf4e59c146fffe822c0784544b67b0ca3c9022a91e5f1f053d27a7aea4a7e359a5e09f021af
SSDeep 24:97zNNL5Xi73V+R3IYoXKD2h7OOOJrCThsNSxDGmkQyohMhrwUEAtz0fCjKWMd3zH:97Lxi7kVzo6D2h6OwQ0TQcDTB0frtr
TLSH 8321D85CE1239560CE93D8B8A19C132D610A9A78168DE6A5A677688163EB014D7ED134
3351888ae9c8a26ed6f8196217120fb5
Malicious
photov_922261487861.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_670566065270.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$mdgl huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
3351888ae9c8a26ed6f8196217120fb5
Malicious
photov_922261487861.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_670566065270.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
3351888ae9c8a26ed6f8196217120fb5 › photov_922261487861.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$mdgl huhuhuhuhuhuhuhuhuhuhu
3351888ae9c8a26ed6f8196217120fb5 › photov_922261487861.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙