Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 5a991dc41cc781abdf4e43e7ed7ddd38
Sha1 3e025e6f7483e10cb193ecf81cb08dfa7a6d8f17
Sha256 a676d96a6cd9ba873d84bbcbf8b8defea62987ec83b4258ee6305d9f5ca1e442
Sha384 3439ee32a60f2deb4fa7025272ccbdc15f89c89b3af5af2ddc9fbae05083ff050ba1f00801b3d90f9ca09123d1057a4c
Sha512 dcd39c453a425b4b8135e31c267f411dcddd8aad9536aa858b6e2789d7a7187aaf849676406911f1827928b8d753d4166d2ee35fb8d7c3b7e6f63b2dae228a04
SSDeep 24:9g0/GVrIGaLzGDcahJyM9nJUFKPLxl7Jex4Wo5uZmSfl4J0HZ/xNW9UZ8rj2xA0N:9M1uzdyJUFKZJ4PlHV+yL1t
TLSH 2E210A8CC6FADF24D702097B628C9D60ED73C06012053A811F38FA9EA27CE6EC271497
5a991dc41cc781abdf4e43e7ed7ddd38
Malicious
photov_199100271286.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_666029272616.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$ms921huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
5a991dc41cc781abdf4e43e7ed7ddd38
Malicious
photov_199100271286.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_666029272616.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
5a991dc41cc781abdf4e43e7ed7ddd38 › photov_199100271286.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$ms921huhuhuhuhuhuhuhuhuhuhu
5a991dc41cc781abdf4e43e7ed7ddd38 › photov_199100271286.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙