Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 5cf75f9bd40078ec6735432a45465f41
Sha1 27b39e589a94d6b1db24d865bf87d49108372686
Sha256 8a35e0d54705468f906b13a8885926c5b9db021f48678f1cec123931e10c8607
Sha384 7e6840b77262936c98a887fddd6da71312d6307313e5bbe482f5f8d7a20c0d5cbff92d34be086d251005133cd3ac2118
Sha512 6726a95281d74c2029a37dd048012e1047ff5938c1ef2c9f168acdc3f9f404ba10f0471f14c167128307004a6c0ef4edee639c75bec8a2d2b4b8d396176f4d46
SSDeep 24:90ETmYjMakUPkaj2dE0k0euk//BwmSXFWyqhFBqu5Aq:90ETmsMxUPlGEaeD/BwPoDN2q
TLSH 8721E762C402F000C043FD3D3651F5952B4ACB0FFC12B76777AA206E74C49D0864208D
5cf75f9bd40078ec6735432a45465f41
Malicious
photov_305211494034.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_970926274665.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$n8exrhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
5cf75f9bd40078ec6735432a45465f41
Malicious
photov_305211494034.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_970926274665.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
5cf75f9bd40078ec6735432a45465f41 › photov_305211494034.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$n8exrhuhuhuhuhuhuhuhuhuhuhu
5cf75f9bd40078ec6735432a45465f41 › photov_305211494034.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙