Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 70a23a145a51d1f0b5c6e5eadb163f69
Sha1 44f3695703af3e955125906661d43bff490dc85a
Sha256 ff84d11896cddc9b28da090163fb69ffb7b0a0016e9100e2f956570996656f14
Sha384 a1a70058d378efda1285e565a0110e05f8d40a61f96f297f0f5465adaa8071d943e89d7eb961287a792c2ed1a491ad91
Sha512 48e9ef4efb7642717c4a5efed03c864b7a1ee34646e24afff358b66e6f3d4e08a6be3d84679ddd638f7bead3913181712568f12d59a4c6205c20f2c2bf46700c
SSDeep 24:9ab7orgYZCnkPF4r02hRMj00/imS4+Jl8jGGC/dX:9ab72gYZsc4wsMj00KP4+oC1X
TLSH 361194BAC2490C10C842E0B42C5166493F2E29E439B2A9770A05B3131F494ECB36949B
70a23a145a51d1f0b5c6e5eadb163f69
Malicious
photov_097378008727.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_047311679895.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$jir60huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
70a23a145a51d1f0b5c6e5eadb163f69
Malicious
photov_097378008727.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_047311679895.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
70a23a145a51d1f0b5c6e5eadb163f69 › photov_097378008727.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$jir60huhuhuhuhuhuhuhuhuhuhu
70a23a145a51d1f0b5c6e5eadb163f69 › photov_097378008727.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙