Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 5d700b84d797a6f0dd5559df7e52b13d
Sha1 3e0e68dac08679991623267ac455d43bbd8ec328
Sha256 a733d8137e2af4ecd322026b8f921330ea7cba04fb2f3a117b21597e45cccb0f
Sha384 110e2c36c82818370767dc4ef7cba161af092cd4924dcd0c6f65be0b56e84ad27caa8159a32c6687b681ba750b332940
Sha512 ca4b5d380c23b18d251d78e91df0b42c467b8292663bcf5780d7a9be8c065439653696caed858bd29a71fdb84171fc7fd4921f81942b7d6e09d9cedc21c3d1ce
SSDeep 24:9gyyRFjxCqU6sleW44+Zev4lKgy9tPfpuo1AotyWmkJR8MhrwUEpPAYW5ylVP6y1:9R0/CnleW44s6xRuo1JkWTDVDO4YN/WI
TLSH CE21D5A7C6965950DC9602F23E8CCCD6910D10D83F3682A3CB5A64B5F003AA633E933B
5d700b84d797a6f0dd5559df7e52b13d
Malicious
photov_849598023791.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_150848431120.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$fzgf8huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
5d700b84d797a6f0dd5559df7e52b13d
Malicious
photov_849598023791.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_150848431120.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
5d700b84d797a6f0dd5559df7e52b13d › photov_849598023791.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$fzgf8huhuhuhuhuhuhuhuhuhuhu
5d700b84d797a6f0dd5559df7e52b13d › photov_849598023791.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙