Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 77fc962565387d172591a296f30c08b5
Sha1 7839674ad66aee7c73d12c3246538cab81da0919
Sha256 05a30c96dc70ef966c86dc75d5ac6d5c45775cc8a73b74a1ed8a0b93b59f5d73
Sha384 409ba796b0a519e45bd38c2fcf9b649232394e5a19cc68b7ca2927208969f44df419438904ee65b9d1983607d9077484
Sha512 c985b46962acb9590abd6647819eb73284f66d3ee9532aca7335f6c045d27b5ff740b5cf89d927d5c5305981d572cbd17f45bc5a264e0b6856aa3f51bd715e21
SSDeep 24:989R+4TzYtYv4YJztw5lc8UuRKd9EclgOvf1DepmSdX35bpWqxJ0gWePo9aFr:9BqY+NzuWuOvtKPNnWO0Hwr
TLSH 2421DA65A45C9D83D07B497FCC55D42269142B793712BCA7078A3D45BC6FC24C3376D4
77fc962565387d172591a296f30c08b5
Malicious
photov_802353782493.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_976575478882.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$umq3 huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
77fc962565387d172591a296f30c08b5
Malicious
photov_802353782493.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_976575478882.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
77fc962565387d172591a296f30c08b5 › photov_802353782493.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$umq3 huhuhuhuhuhuhuhuhuhuhu
77fc962565387d172591a296f30c08b5 › photov_802353782493.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙