Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 68f132823b3163838616c91c4f8216b1
Sha1 b5d88c4555f2b6ae999962ab94311f1406a7e354
Sha256 5cf6a143522f1147aacaac15e5c8ee5b2ae9b4d2e3dc196cb20ba9cd709a241f
Sha384 261b9e74c8d3a1ae856ca5ed3e8799edaf3f1260cfca429109fa900534321ff3f84126fa3c5bb4ea566b789224d6e1e4
Sha512 bce7506d13e908017007b6e6434876c4572171c42ddc658262b1e6ce5295121ce3ae7a2cdf6e0dddc7522506f7d13f9f54a95a98afbf27144b0173ac15465fbf
SSDeep 24:9W9MnucA6rJ/qSE8Cw9L/RQRwHmUyBXk7mSDHIctxi6HBO1afh6wITY5:9W97cAGdnE9mL/Rmf07P0w+Sh6g5
TLSH 7421A388845DDC00E80DB179BD399C286C7BEAA72B088B829B1D74763F8AB401B41D40
68f132823b3163838616c91c4f8216b1
Malicious
photov_642473740476.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_639823807210.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$o3cpshuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
68f132823b3163838616c91c4f8216b1
Malicious
photov_642473740476.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_639823807210.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
68f132823b3163838616c91c4f8216b1 › photov_642473740476.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$o3cpshuhuhuhuhuhuhuhuhuhuhu
68f132823b3163838616c91c4f8216b1 › photov_642473740476.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙