Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 72b530af80fde3b379ce0c1a345fef82
Sha1 4ff30e4847cc3f6aa3f3295a1e19f84cf67b2445
Sha256 1e23e098322d0bb0085a7da23ed0dc93eb0538a96e146553cd1a384bdd7fe39c
Sha384 cef274f064d4e21fdef15bd8a4e1df116ce8edd9fdcdfca0e54b55293eea512aa47a5e9da6001c6ac7dbd243424ba5ea
Sha512 8076f0c52581e52881d65037f52da3cf3a6f8893f22d87f62fb32505f67a4a504c7dc609b199d8e4667721e6c896ed0e8c98004bc2f37e22cfeeec0a23163441
SSDeep 24:9jv7TiiiW3aK9i/ZlqTJasjmSAEblZsWq/KqLBacFqX9/kB9mW7jl:9rPitdxlqYsjPkWSKr4qaDjl
TLSH 0F21B7B5A729A940F0CF823305129A1914BE09666C16087E27F76B567BD1C4C2A982FA
72b530af80fde3b379ce0c1a345fef82
Malicious
photov_541097563367.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_088145556554.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$rfh25huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
72b530af80fde3b379ce0c1a345fef82
Malicious
photov_541097563367.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_088145556554.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
72b530af80fde3b379ce0c1a345fef82 › photov_541097563367.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$rfh25huhuhuhuhuhuhuhuhuhuhu
72b530af80fde3b379ce0c1a345fef82 › photov_541097563367.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙