Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 63babb6da9cc64912f245418f213ca64
Sha1 fbcd6ca7ad3a3e80439ec9fe58d07ce60398190a
Sha256 a0e701cd1eb953ab66075aabc5b7c8640d802a3d1280c78fa8e4fc553426f9bb
Sha384 ccdb218cf4b577362978f09e357ca7ab1b6428842a76d9c59d2b29ae8a6a2794d6be09fadd0ae896d40e1c4411241bdf
Sha512 29198fe0b19dc8b32c36fa93319573bc5ffb21e40360996bb146730aebdff0680c332fa0821d296ff8fe70aaafa886b4028ce20becc82d7fd3558f6068531227
SSDeep 24:97N/cy4SKZ0pHK7JtuMvkuL0mSm0bdWqhck3vjCLf:97fvKK6JGPPWCcD
TLSH 6221E5C086230800DC02433B8A19BAF2B63971D10984A13FBF373F58AE3B8C631005E4
63babb6da9cc64912f245418f213ca64
Malicious
photov_095071625598.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_803919491353.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$d1lcchuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
63babb6da9cc64912f245418f213ca64
Malicious
photov_095071625598.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_803919491353.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
63babb6da9cc64912f245418f213ca64 › photov_095071625598.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$d1lcchuhuhuhuhuhuhuhuhuhuhu
63babb6da9cc64912f245418f213ca64 › photov_095071625598.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙