Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 391440151fc54eca7453531716d50cd4
Sha1 653e7244651d5d6c894281dfb81a03f57f5a7dd9
Sha256 dd47329fb4c7ea6eaed3c72a609cb88d93d5edca6dcd0f45b4c207e2eaa50f72
Sha384 ebb461e9f4b6fd16950f03ce2d9966b72cbcedf2dad87b21d76591c164634bbb823d63d371ed6f7e0508a6388a74b38f
Sha512 4c0c8f40a999fa9f22bfd135f0a6df570d01a7301a8d6f313980e6fe82d405e4ace18087cd1026aa78726b0a1cdc015c369193fc0277dca600981bae497f1f7e
SSDeep 24:9IrFUriUFn6ULarwLR9LlEHw9mF41dsKs3mSnzNHUVZ/mEr9HX:9IxUui6anM9F4X8PzWVZ/lZX
TLSH 2721639E49D0DE41DC4643B766FD95C68B2506ECFA09B19A0BDC1693FD0D7849A8E1C0
391440151fc54eca7453531716d50cd4
Malicious
photov_079359259606.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_641351551552.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$nrqbihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
391440151fc54eca7453531716d50cd4
Malicious
photov_079359259606.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_641351551552.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
391440151fc54eca7453531716d50cd4 › photov_079359259606.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$nrqbihuhuhuhuhuhuhuhuhuhuhu
391440151fc54eca7453531716d50cd4 › photov_079359259606.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙