Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 4c6b91bddfd71e3a7cabee67efd284c4
Sha1 286f022416190ec260d5c91b091c9d4ad79075b7
Sha256 0bafff7ff608cec6f014e50d6496f9f9592cac6f64e8bfd513740b18f75a91d3
Sha384 17c998f5408d10f4f3302df9c0a816c9065503de5b78a2ddaf222837f55757dc1349cad22657dc72cc5c77e9616b6a77
Sha512 9862f7736955c05a52330bb5f0040945340af07b28b749c2e059d4f4a718d38eb4d7d16eeedac4dd18b6e6e620c066d07d8a343e83db7def20e553e879ad4c5a
SSDeep 24:93+2nzUn2cyyp94wTvYruXuZreYA0128h0yWNUr0mSZnhGY7eE4vL3DUr1X:93ODP7XqrU0AFur0PbGY7+vjIr1X
TLSH 60219310A9A44E0ED9CF633938BDEFE51521A0ECA4078653271468FCBA91CC82780ED8
4c6b91bddfd71e3a7cabee67efd284c4
Malicious
photov_924912653169.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_151521933733.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$pl4r0huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
4c6b91bddfd71e3a7cabee67efd284c4
Malicious
photov_924912653169.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_151521933733.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
4c6b91bddfd71e3a7cabee67efd284c4 › photov_924912653169.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$pl4r0huhuhuhuhuhuhuhuhuhuhu
4c6b91bddfd71e3a7cabee67efd284c4 › photov_924912653169.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙