Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 5eb9537fe1a17df94427d1cd7498794b
Sha1 ea79cd910bd4f41deae08df081dad1a01e72a43c
Sha256 d477642c07754f3a525886c90cd61c039c45c9fb9232386dfae985228d062f70
Sha384 0e43284992051b7359b41610e276a96b8c8c8a31debe7eb940fcb867a3423b394d15342081b68edda338bca2df76725d
Sha512 328080d7a751af81b6f2c1c7fdbdf000ff5e7c4cb2a69d3eea49fd3e77899d62200c98b96bca7345d391d4ec7e94594762d1f4f44b4c38cfe70a86f5cb2dbd75
SSDeep 24:9/DYHVOS+JnxcKSX4xhjumN9BCZJxWEXLKPZDgmknODAxYBq55XrDotn:9/s1Ore14xhjumTMgE72ZMTnSsct
TLSH F021DBE1D1CFDBD5FB63CC343C6A1A6A372604448B1B81472479A60D74A78CC531685B
5eb9537fe1a17df94427d1cd7498794b
Malicious
photov_673733255495.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_955993573490.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$u34z9huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
5eb9537fe1a17df94427d1cd7498794b
Malicious
photov_673733255495.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_955993573490.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
5eb9537fe1a17df94427d1cd7498794b › photov_673733255495.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$u34z9huhuhuhuhuhuhuhuhuhuhu
5eb9537fe1a17df94427d1cd7498794b › photov_673733255495.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙