Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 63662fcbc1c44c22fb38d2ddb88ba436
Sha1 c7be326678e989ebf23be72a4a1ab36890594624
Sha256 79f402d7d3ec9e53e03aa1b4fcfc39be316a224f00f0730d863ca70ee74e2a1f
Sha384 15bf35227c689ee0ba5e3c74574606c72d655b023f87b8c4822ccea13789d5e8661183488fd681725bf7534f7292b4ae
Sha512 fc868fa85269f949847d80e8bd8f279d274c5b2f57abdb839a71418a93a6f825c3a5d5def77f5ea43ab9a2727a6ad44af898c92f50fc6a1d94a004926e9bf3bc
SSDeep 24:9niNDi22C1ygr+WBG+Oa2kGXZzXdrp8lzZ/fQdD7Fr2wZh+AzHAmkfYF+UaNuUaB:9HKzr+KOdnXpNN8lV/m/Fr3HxATfYF+4
TLSH D42108DE8106C3D4D11BBB32B8D5165432AC5379EE7585812222988ABB8F1862FC763B
63662fcbc1c44c22fb38d2ddb88ba436
Malicious
photov_154131790460.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_553308487713.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$vndw huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
63662fcbc1c44c22fb38d2ddb88ba436
Malicious
photov_154131790460.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_553308487713.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
63662fcbc1c44c22fb38d2ddb88ba436 › photov_154131790460.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$vndw huhuhuhuhuhuhuhuhuhuhu
63662fcbc1c44c22fb38d2ddb88ba436 › photov_154131790460.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙