Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 57c668337fa364b2362915eb6eb6b1ff
Sha1 cb32b3776f8e6d05e9de898cf143ff602608247d
Sha256 4eac4154ff880410fa6ef526c82edeef040ba804d8d9906b6d876cf696ab2af6
Sha384 0986e7c60e998f8895c7ed3ad5d029d2240006c2c163b97c8d600992114e3c1682f357d104bc78e004752592996b7e86
Sha512 f20ff6fc3b887bd27eafc0e4575101f549372291b848147558407c74acb7f24b19d49f80c32dde4f74001d54a4d6c780aa7ab878a9ca35d7ab149877b2264c68
SSDeep 24:9ubibz2D3N9lqLPalrwZYv/9UCk7CNmkK3pC4P/OINo9fIr2UUINwVeC0:93XSlqLipqY39UDOTK3pdZoG28G0
TLSH 5F21A8513190E3D0C81CA2367C469C0953AA197D960E14279E5F019A3EBFEB953118EE
57c668337fa364b2362915eb6eb6b1ff
Malicious
photov_855714895463.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_897338441402.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$axbkthuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
57c668337fa364b2362915eb6eb6b1ff
Malicious
photov_855714895463.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_897338441402.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
57c668337fa364b2362915eb6eb6b1ff › photov_855714895463.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$axbkthuhuhuhuhuhuhuhuhuhuhu
57c668337fa364b2362915eb6eb6b1ff › photov_855714895463.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙