Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 4c14224512c5ee38598b622dd273c44a
Sha1 81df1da53003c2dddd49783f5af467edc3cc4721
Sha256 4bf346f188b49ff4bcdb6b55bd31f3812627842acf8e34ce6fab363193f03427
Sha384 53d41552085c18c65bfcf9db026e0a10c6e6e38e0b36a9d522daa4ed599782f89c88532722fc1bdec26c88f40de601ed
Sha512 8dfd157887276958ca162ad69a48fde195602c972a4ebbb09649ce8f88efa0f9624d0cbf5c8295fa7af3c13a257b65e8d7e91c75a52fff7aae9da97b6f82c10d
SSDeep 24:92ebUr3YVp4xi2JfVzI2V5hsBAbh9FIp23tqv3mmJmkRE90ubjeYgmKMeCbN:9o3JBr1sBA0222+TR+lbLKA
TLSH 2F21E76890C74EC2D8D349BD74283E0650A1E530C25C2F6B459873DE1B55FE82F2ACC4
4c14224512c5ee38598b622dd273c44a
Malicious
photov_516026808006.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_835976969114.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$idmrkhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
4c14224512c5ee38598b622dd273c44a
Malicious
photov_516026808006.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_835976969114.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
4c14224512c5ee38598b622dd273c44a › photov_516026808006.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$idmrkhuhuhuhuhuhuhuhuhuhuhu
4c14224512c5ee38598b622dd273c44a › photov_516026808006.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙