Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 7790826cbc180591876e1602065de0b1
Sha1 dbf77208abd3c173f838b170eb6ef08bf934ca16
Sha256 994ce8657997d283ab752bf0d48818df0b703b92fbc445923c2088dc422f8dc1
Sha384 02345dbcf57383c88334959257468ba8a72fb8edfe43535e1f6b71da2e6813294bc252a092abc7807d607fb6a06d2d39
Sha512 2e856872b9ec6f8187b5df03e54023c0607f8a3f35a627ffba7e5d247c3b8e8df4b0d9f3c4bd44e97f905dcc53302b5f22412a589d93c73863ff49999d84f926
SSDeep 24:9nqYzjLRtX2Wm3iomIGpEyA1QUw+U1zKZmkki4P/OINoa5KqxcqC3Ze:9b/LRtxhomXmd1QUg1iTk9ZoiKAL
TLSH E721B7CAC1A2ED95DCC72075F4CA492E9225446EA30F413CAF5501DAB61B74DDB86425
7790826cbc180591876e1602065de0b1
Malicious
photov_425234711129.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_180982038961.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$qbhc2huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
7790826cbc180591876e1602065de0b1
Malicious
photov_425234711129.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_180982038961.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
7790826cbc180591876e1602065de0b1 › photov_425234711129.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$qbhc2huhuhuhuhuhuhuhuhuhuhu
7790826cbc180591876e1602065de0b1 › photov_425234711129.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙