Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 5c353ae73fd9526a9810116f37dad97c
Sha1 c7346a5b5c9368c88c2bef3c0e5daf50cc166a7a
Sha256 ac8c6da8b99c9b57568ced3a3f0ab31ff5519680a374ba928451e05ccf4e92fa
Sha384 35d979ab3e17e464847007b673deec017428af5ab363cf4686d8042a2ae903269e122b4b1d243409eaae2000c30014b0
Sha512 ee92d1a721884f363838a39ffca675c54cd1e65bffbb24674dde99513eb7ef6544c0f70fe9390131a81c25db2d8a6f4c612bf54313cef9c37bcdd9d5e5cb5076
SSDeep 24:9TvgL/0GJ5CmYBiGPhi4xCbiqu3a0MmSNEHIbbjaHjRqyb+MkngaQYU:9TIL/j5Cji60aciqulMPJv4Rvb+MxaQX
TLSH 8521958C006D1C90DF4F967B6FFF5E0698812B9CB819102A2CB33DB02D5E2953F4A06C
5c353ae73fd9526a9810116f37dad97c
Malicious
photov_431787658628.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_766410492597.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$kcvobhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
5c353ae73fd9526a9810116f37dad97c
Malicious
photov_431787658628.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_766410492597.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
5c353ae73fd9526a9810116f37dad97c › photov_431787658628.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$kcvobhuhuhuhuhuhuhuhuhuhuhu
5c353ae73fd9526a9810116f37dad97c › photov_431787658628.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙