Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 560868956aa8479f9cbb0e8ea592982d
Sha1 4a48290e3de3bcc731bf8eb66d4654d5abcea7df
Sha256 72e912ae8db4fd029743b733c7309b9619e0ef13d1ffb09e367315a91a7d7417
Sha384 4acfa1657d4924f8ad64d800b3b698cdfd29906e70e6d4c368ec41f1fb064070a5e07e813a5fd4e7204dbcfe9e15d4d9
Sha512 4a2c43a4d49f7fb1a033f2e0e0cc1f533b4139d7b02497d1b4830e0a1f55db7fb6354427677cbf33e720908d88e138ad5e7cbd88dbb62b0e7c8a781567934659
SSDeep 24:9SbT547838/MIjx5/DwoyS9w6NmSgmq+Jl8xjIa16Ia:905b8/MIjx5cPGPW+HKK
TLSH E121A7A0910BDFA5DC93D3365C85AA56735E1182A770B42B978C1F226E4AEC8770264F
560868956aa8479f9cbb0e8ea592982d
Malicious
photov_791717306049.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_573726471490.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$rnx03huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
560868956aa8479f9cbb0e8ea592982d
Malicious
photov_791717306049.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_573726471490.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
560868956aa8479f9cbb0e8ea592982d › photov_791717306049.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$rnx03huhuhuhuhuhuhuhuhuhuhu
560868956aa8479f9cbb0e8ea592982d › photov_791717306049.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙