Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 7118893f06437e44a7f1ad74e3b733f2
Sha1 0d06d41b5cb0267d66db8ab0f2380d34a5225376
Sha256 e24533456a5a40db59af85a1d9ae2687f6ddad13d9ebc36e32952a68aa1ac1b5
Sha384 3f2d2a427f92b35b406b51f4e0809038a10f31961b576e21e393dbf7a2df4e2437dbb7665a7028b7eb7c1dee0c6e25b2
Sha512 26f14768b43dfca26724bc84656c67e4e90fd363ff93fc512c7d7f30d93a470a936c40e52a18b83a104e66838b61a84248105bc0aabb41b956503840639fad05
SSDeep 24:9RWrxJ1SatAjMCnZ2xTo7rRHyAbyu8mSVHukrQYA8dxDzzUGQRNy9s:9m/tVboPcAbGP8YA0E/D
TLSH 0621B494860BEEC0C873C33908B9C19A563427A9731003EB2E1DA5B21E49F82EE1B211
7118893f06437e44a7f1ad74e3b733f2
Malicious
photov_506034851982.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_280918246554.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$zligdhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
7118893f06437e44a7f1ad74e3b733f2
Malicious
photov_506034851982.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_280918246554.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
7118893f06437e44a7f1ad74e3b733f2 › photov_506034851982.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$zligdhuhuhuhuhuhuhuhuhuhuhu
7118893f06437e44a7f1ad74e3b733f2 › photov_506034851982.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙