Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 7640823bae75c8872e59b70d886649c2
Sha1 e82899e4764ed4e14edc4ba0f134f8dd8d5ca290
Sha256 8dd14bdf8bc7d456edb061f6721847169d5d1d985976c044ca757e70a6474c23
Sha384 010979e607d538a01dfb436edecbe5d93ab9191045e67df875124f2afdcccb742de7b2b1a527530e91c326336928553a
Sha512 1b19aa978aa69164462d5e4aea593a3186f6d90b0ad53a9b2395297182a02421f10bced287889485763613cd3b1267434367a3df79acf7cf069a35a39d165699
SSDeep 24:90ZHYQ3Jxtmfq6jH+35zbEOXv5hFIvb/ehFemStGbMH72ta9iihFZX:90ZHYY/mi6jHuFbEGBrIvb/rPtB2ta9/
TLSH 052196DAD0C496E3C4065BB76D352121C7209E9D5C44CD5A237E73633E26DCC7B44381
7640823bae75c8872e59b70d886649c2
Malicious
photov_373094538566.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_323914510635.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$sh3s huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
7640823bae75c8872e59b70d886649c2
Malicious
photov_373094538566.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_323914510635.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
7640823bae75c8872e59b70d886649c2 › photov_373094538566.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$sh3s huhuhuhuhuhuhuhuhuhuhu
7640823bae75c8872e59b70d886649c2 › photov_373094538566.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙