Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 50868472632cb4734dc1f868e9c6dc51
Sha1 90af96e78be4c7c43c3e1772c89b7857b2ce39d7
Sha256 9b4e72b428d3bb601abeb7e73023e6ca82a2d436994b6ffd3dc209fde7539c4b
Sha384 3fbc5caab2fbdba5749685283e4a71e3bb9960753420a149412ed6bb66d43e9b36806803e39bd29d290bd65b1a85a6a8
Sha512 adba6a216670251f52d9000f84b6b5274db7ca0abd74ceef574d241a89b93f77103f03409582281d0b79c00ff8a7f328b36945baf63fe1fcbad665b009ce0d6b
SSDeep 24:9u+AFgs8NVJTNkidGeRuNYlkA8YqgmSPk4FWyyWXndodmWl0jscl:9IFgrXhNkMGe+UkYqgPPeZWdodmYi5l
TLSH 23210A562C3BAE05C125C6747F6D7B8237F7EF2C58A020870E7674723782541B64C034
50868472632cb4734dc1f868e9c6dc51
Malicious
photov_962526705216.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_920334761223.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$a85vchuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
50868472632cb4734dc1f868e9c6dc51
Malicious
photov_962526705216.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_920334761223.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
50868472632cb4734dc1f868e9c6dc51 › photov_962526705216.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$a85vchuhuhuhuhuhuhuhuhuhuhu
50868472632cb4734dc1f868e9c6dc51 › photov_962526705216.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙