Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 472ef8efb53396e90e95b888485e66e2
Sha1 7bdabaee4e08cec137646c1bf43e98b3648ae391
Sha256 24e9fa975d54e6a6fe818e9e4ab08f5aaeedb2a8fac019c0aad6e8801d368a47
Sha384 3c47db070a7c1e3c6c81e1d262b1014474b39febf468ac9790e9c2b255dc3ed5726440795467afed78608eb670f121a7
Sha512 3dfb9dcf874a81c8109668fdb9c5657da6bd43c99497e89a95f4396ca2594e0b4dcb77c3539a3ec4c89d0222a23db7fdb89613eb43a21b419d6e7d25efa34ed8
SSDeep 24:9seeq2gCucHtFGAurKXRDPJ5JmS8+FV8myPg4+J8Z:97RY7FgrKdrJP8+FIBZ
TLSH F1216371840DA681CC0A963FADA1D71A56BA09037099413B276826CD778DFE84BA98F4
472ef8efb53396e90e95b888485e66e2
Malicious
photov_504705154244.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_295119292329.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$osm5phuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
472ef8efb53396e90e95b888485e66e2
Malicious
photov_504705154244.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_295119292329.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
472ef8efb53396e90e95b888485e66e2 › photov_504705154244.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$osm5phuhuhuhuhuhuhuhuhuhuhu
472ef8efb53396e90e95b888485e66e2 › photov_504705154244.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙