Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 78fb84d280807080828f9cb7e945357b
Sha1 34642ade307c6818a31030c5bfbd7585be838403
Sha256 a08e8a8b4bb2209ef056079c5344f680fcfb0ef40716b39a949b89428576a18c
Sha384 2e53e04b868b5fedf1cbed54746dcedd966c872e1815835eb46d662d8ccc5a6965af772999d579c921d37a4aa4f63b49
Sha512 7110d941ade270debf51fb228fe982bb7dcc1944d2ebcbf1a3561fc48478921d05e5391780be89f320db416948d4edc05f53adc66175c7ae8b222f22dffa9640
SSDeep 24:9eyu75w8uEBnmi6Z2KCaxhDgjmSHLGHMnJX+DPTy6o7:9DCvuECDCaOPrRnZ+i
TLSH 0121C644C25BC6C5C08791B83CD6BB017523C748912138950F92E1803E4DF8C3B17370
78fb84d280807080828f9cb7e945357b
Malicious
photov_097644227821.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_632860691283.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$b48_7huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
78fb84d280807080828f9cb7e945357b
Malicious
photov_097644227821.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_632860691283.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
78fb84d280807080828f9cb7e945357b › photov_097644227821.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$b48_7huhuhuhuhuhuhuhuhuhuhu
78fb84d280807080828f9cb7e945357b › photov_097644227821.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙