Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 5ac8f48d4cc7ff3266d276cf787be86f
Sha1 ae1522f0e641d077af5cd816341b6f64ebab4a4f
Sha256 a4fb08502584cef608e7ae33861ae1e28aa8c28929f431c0cc35c5b53f786af5
Sha384 5f076ed1dc8b0f882db7900509ca0e64178d9167bd979d302ecb455e535d4183a6c569ed27b8fe3de24c9b87525fcff7
Sha512 76e35948fde766b03189987b313b8f3502bf0da47c737269494755a6d5376fbf62216ecc54971d115e633a9b89c30d252feef12404108d94e1c1bc572e99036d
SSDeep 24:9tMUtiX8cji+eZpiZEY0jb3AfNe6pLa7BtqZFIBGVEtfZmSJX4S9SF4jbkUUzt9x:9B9meXi6ZP3AfPa7BtqZygE9ZPJZgFwc
TLSH FC21A3AA60BE8841E50ECAB8345E9B492A4E854C44E4F38762647D0F3C14ECC970FBA3
5ac8f48d4cc7ff3266d276cf787be86f
Malicious
photov_763028390865.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_337744622682.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$g6mw huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
5ac8f48d4cc7ff3266d276cf787be86f
Malicious
photov_763028390865.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_337744622682.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
5ac8f48d4cc7ff3266d276cf787be86f › photov_763028390865.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$g6mw huhuhuhuhuhuhuhuhuhuhu
5ac8f48d4cc7ff3266d276cf787be86f › photov_763028390865.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙