Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 5dedf41f1a35c6efe94b0baafced09c6
Sha1 ad9b5d0b12dc1e03f0ceaad1960ddf451065fa60
Sha256 8d90e90104e40c211a7ff3dddfc4196f3141200e80048f4c09c1fa86c7b2fd62
Sha384 e46afcffeafe6de9ab94207c18600a5d4cbe1c1e07843863247334edb41adf99fb70ae8f6a8616ad9d9aaef4ea51659a
Sha512 d3d39e5eadb8c11184326843e28d0eeec0c48e53f9b3d45fc42384d0c3ac0ed46515432727ab2d74f70024fc5af304302acbac82a500dd5804627f35c47d4343
SSDeep 24:9o7CBzT9nSxrzKQ6iLo+TdEtYviGcumSmH2kmXt8JzfxGgXQH0w:9omBzTkrUfwEtPLuPDpEJZK
TLSH 7B2198C4661AC4D9FC8786B57C721184CA7D1F94142017B255862AE1BC96B4DEBCE7A0
5dedf41f1a35c6efe94b0baafced09c6
Malicious
photov_424701176963.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_863738701530.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$kzuaxhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
5dedf41f1a35c6efe94b0baafced09c6
Malicious
photov_424701176963.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_863738701530.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
5dedf41f1a35c6efe94b0baafced09c6 › photov_424701176963.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$kzuaxhuhuhuhuhuhuhuhuhuhuhu
5dedf41f1a35c6efe94b0baafced09c6 › photov_424701176963.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙