Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 5bbccbf44d17e8fe4dfdf158789fc306
Sha1 8250162c4d49735d2a96628cd28664e96a6673f4
Sha256 e327ffdeefa77cfd6eb494123be76d4cb1111bc4f689f36de3b08357f587de4b
Sha384 1470be44850dd790d1152b2eedc8135bdb34696d77ce61bd050f1a0c1f68eb2091976e7b4a5d64651b8bf74003dd753f
Sha512 312c3f02f6b6aebf84e7a23c35ba5682b72659348a1173dc3d70260294d28b02cc4063c273d14ac9b0e717b77dfba1e8d4d1d786d1fa4160e6121775e5a59b8b
SSDeep 24:9SNbMhpolrmCV9xXvqTiFn/A4HRmSmUBv/DYJJxm/r0VBb0Emuq9X:9CKpmDATi7HRPmIKi0/bOuoX
TLSH C421A37C854C8B53CD174A7BB7278A0A63B6C845620220427A29B233B1B34C5EBA21A9
5bbccbf44d17e8fe4dfdf158789fc306
Malicious
photov_860775411147.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_007829574817.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$ktn4phuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
5bbccbf44d17e8fe4dfdf158789fc306
Malicious
photov_860775411147.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_007829574817.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
5bbccbf44d17e8fe4dfdf158789fc306 › photov_860775411147.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$ktn4phuhuhuhuhuhuhuhuhuhuhu
5bbccbf44d17e8fe4dfdf158789fc306 › photov_860775411147.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙