Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 78c3d1228eda5325858c25b729133672
Sha1 04c41f63325c10fdbaacaf1b96da35f0db098f78
Sha256 d7c3b3e9ee4cfc3cac71ee8cd92309e4115360af5f7e155aa0d67e13a367713a
Sha384 e5e076c7fb9f943d64f7aa00fda672f1c01503c96ea36d466dd081ebf2682b91b36af48fcfb530ea5d3bc3d62bb56381
Sha512 460a0b9d6b417cd7285a6f110b4672ee633e734eb1d420a4531a7bb69ee267b74513ba07fd971061aa6f6d2ae88130ff350ac86b1fcb7883c18b5f09cf2e1f92
SSDeep 24:95yDBbYC64nVDcIBfuj/6W3jB9lKbwQxEwmHumkk0XMhNmW8xwu0r52acwfI:95tCD1cIBfujn9UbswmOTkPNDuwT5Vs
TLSH E421E94E5006B20ADFAFA23619D5564E3CED05A19B5EFAC247723EF2F4892980A40112
78c3d1228eda5325858c25b729133672
Malicious
photov_953091616750.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_039810395331.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$jt9e7huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
78c3d1228eda5325858c25b729133672
Malicious
photov_953091616750.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_039810395331.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
78c3d1228eda5325858c25b729133672 › photov_953091616750.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$jt9e7huhuhuhuhuhuhuhuhuhuhu
78c3d1228eda5325858c25b729133672 › photov_953091616750.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙