Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 559c9ca93850a195377f1d6c99f9e15d
Sha1 54f4dcdd091614f0da77d2150cc01daaef87d267
Sha256 a8d493f5ea1bf425df6223bbf8ad21816c6576ba57052c7b5e80c6a178249bd2
Sha384 361813c3353ccdbdc4d451bd5195c21e7ae23585e43522743f1b22de91a4869d359b38c29f2bf6fdbce696ccbac1c809
Sha512 cf578286dc7b440322cdf59ebcc50377f8bacb8bd066d72e393de6bd2ff0a8359faf26c69a2fb48efd5b351a0f91ae0edeb85c167c292713d794a19f084d8a44
SSDeep 24:9cDuJ/vmHJmNufw/YtIbuXKyZ1fujgvZV4P+DkvSmmSzRs++hGY7mSaZ/9cfcjcR:9yI/vmLwoISKyZZKPJvvPzRaGY7yZ1cz
TLSH 3C21C8B3999CCC41D29743BE2960DE4E77DA8094312210E757A59AAD392FFDC8F84944
559c9ca93850a195377f1d6c99f9e15d
Malicious
photov_188029018908.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_920041128705.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$ezc6lhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
559c9ca93850a195377f1d6c99f9e15d
Malicious
photov_188029018908.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_920041128705.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
559c9ca93850a195377f1d6c99f9e15d › photov_188029018908.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$ezc6lhuhuhuhuhuhuhuhuhuhuhu
559c9ca93850a195377f1d6c99f9e15d › photov_188029018908.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙