Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 54690ab040a23434a2644d03baf2c209
Sha1 b20009a07d9e33eb509581d652c40d57c23d2f2d
Sha256 4651f6fd78cb8dce882e6a480f90bc3d4d7f9fb0954934595d376ca640010c95
Sha384 b8756b97247d8b64c7cbb11cc9b4454df5c4065e87a449f263d946d4cccdb53672b8ae73af9e8681b3b4acd7dea0322e
Sha512 9cb639d98baedd37c15c5e4b9193bf19701bc4b44d1a298ac3ed6926d5e20b3def9165a64731bd90d143fcf9f1195dccb1ab47468751cc38c23aec44ee79a3d3
SSDeep 24:9knh3kYWCh2D7ZnZAAy0v3DHpwCD3F0kjImSsJJxmEWL3mjkAg:9kh0l42D7hes3Nw23F0kjIP+QLWj8
TLSH 3711B9B454E29989CE0BE07F3BFF4A053710A6A76610615A1BCD7BB5FC8EC48E3C6040
54690ab040a23434a2644d03baf2c209
Malicious
photov_434468963769.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_505380789566.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$nknkthuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
54690ab040a23434a2644d03baf2c209
Malicious
photov_434468963769.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_505380789566.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
54690ab040a23434a2644d03baf2c209 › photov_434468963769.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$nknkthuhuhuhuhuhuhuhuhuhuhu
54690ab040a23434a2644d03baf2c209 › photov_434468963769.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙