Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 4ef33dfd53330572defac178810f8e47
Sha1 a4622bf16883e4df193bd2fb70fcf79b6bc75f56
Sha256 cb825977362f38b7523f7b2a40dc14ea433d4c9f7fb2281f8b2a3675be7250b0
Sha384 24cd371e6c35674b519819e58c4a2d506eb62fdeb934e8a733847e0691c2b9d875430aae85c742127b32d85a6356c712
Sha512 a480f8b9aff4eda1ff449477cafdb927f7bb8d1a0c08dfea9b6f83c1d02567546c2e5cdd139e8fd062d20f82041d4ebf07c51eee036d6033cffcfb8c0f7126e1
SSDeep 24:9dq7lg3/loMg7bDmBwZaT0BqnKAg9mC5xyEuHUmSCbMHTE4E3dRsGfRlKux/x2H0:98ElgP8wZaT0BqKe4xyEDPNQ3fxf7K+B
TLSH 3E21988C816EC651D45392B36C35CB24271989583C19D85503DFB5FEBB09A5D0F14657
4ef33dfd53330572defac178810f8e47
Malicious
photov_855606278985.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_225849951262.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$dakg huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
4ef33dfd53330572defac178810f8e47
Malicious
photov_855606278985.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_225849951262.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
4ef33dfd53330572defac178810f8e47 › photov_855606278985.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$dakg huhuhuhuhuhuhuhuhuhuhu
4ef33dfd53330572defac178810f8e47 › photov_855606278985.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙