Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 4744da37da9baebf88cc4d229450d7ac
Sha1 ff121d0ceaae6d9a8829603b9e1ca61d4946857d
Sha256 84cca5dcdcaf165ff339319fbc03362066825cd8398fc187d75c93411144001f
Sha384 ee1bfa193529238350f812c8da3c8af501563972ab30398716e55f839e46a935d5573ddfb8909e05d83823e25bbfc151
Sha512 4fa2490fcee365f146c8340bf3e925f89c41d5e973fe58ac906c927ec3e9518a62f760d0d96673ee50db604b9b413cb544b9e008169afb5006822de515d83541
SSDeep 24:9dua5WMbkzlkpw/ku/pHK14Tc7OlYdwMHLmc2WNaT+mkYZhanSNbX+2aRmBKFbQ9:9gQWMYlkpXuBH84rYKSLCWkT+T6JmEBv
TLSH CE21E9F94048AD00DBCBC071BA2F9D55E21E86E533AD46A31064AACC6E03AD31F00864
4744da37da9baebf88cc4d229450d7ac
Malicious
photov_685572566022.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_171849471587.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$vp9ilhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
4744da37da9baebf88cc4d229450d7ac
Malicious
photov_685572566022.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_171849471587.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
4744da37da9baebf88cc4d229450d7ac › photov_685572566022.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$vp9ilhuhuhuhuhuhuhuhuhuhuhu
4744da37da9baebf88cc4d229450d7ac › photov_685572566022.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙