Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 46b6502d464df3e092a9573917ea308d
Sha1 97925bff6816e826e3d2b3fe4c7bfd5b679a14ef
Sha256 6e86afed736f21bd7b2f55ae388477cfcb26100c7bd2cd087d9e05e5f8836472
Sha384 5201b7c239d14bb2b2e43fe26babcb2920e69f9743bffe329d18cd2d6d6f5a9efd057f91276e528256020aee327934bd
Sha512 46752378324c961fca3303972b9ac34baa9e5b9074c7bfe4e24c548a4ff8fbcecb9e0889f713111e1457fcbeea38ed22f75ac24028353cd34e5baa025cfbb22a
SSDeep 24:9lxaEtekQXokLEWKsUSzH0SAJ7kZ5mS6yo4mJfJO4kIoiZ3:9lxa2ek0zEWFzUSAJIXP6hkA1
TLSH 1A2196A0009E9140EF03D236AD2D7A636479A5EC3D29D71F3B5D24C33610E9D6343935
46b6502d464df3e092a9573917ea308d
Malicious
photov_335312493306.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_731068793568.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$plk9 huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
46b6502d464df3e092a9573917ea308d
Malicious
photov_335312493306.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_731068793568.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
46b6502d464df3e092a9573917ea308d › photov_335312493306.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$plk9 huhuhuhuhuhuhuhuhuhuhu
46b6502d464df3e092a9573917ea308d › photov_335312493306.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙