Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 67ba4d34e82a882ce690555b1e82f702
Sha1 71a800f1f5db3ba7a8372daebb8a449f9e89eadb
Sha256 1d5b072be68eca8c089e8b78c404b3e97bd9cbc6506301eb0ba260e5c2aa7f3c
Sha384 fc3a26b4ed6d81930711ee34023505b3eab2aac0116993aa4d6a28fcb763768625f3fa6f8c1dbaef7c584a66a8cdb762
Sha512 7901c53cda88f120a7f8db73ce414ba735187923e324bda26e4c71a6fe7fa9f8cb86f011666e5dddb92d74237f8beb2af62cb3a419578d84e106e46ced49de29
SSDeep 24:95o0ECT5IfA5cAwECzD/7WIEhZmS0MyplLuSTUDwZx:9y0W9LPKTPF2Ht
TLSH A01175C48499D920D92DEA362543768D0A3201569D154AAF3271765E3E517E1E30E6C5
67ba4d34e82a882ce690555b1e82f702
Malicious
photov_465157745308.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_788978476919.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$tnx3bhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
67ba4d34e82a882ce690555b1e82f702
Malicious
photov_465157745308.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_788978476919.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
67ba4d34e82a882ce690555b1e82f702 › photov_465157745308.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$tnx3bhuhuhuhuhuhuhuhuhuhuhu
67ba4d34e82a882ce690555b1e82f702 › photov_465157745308.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙