Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 7cb8d3064f4df6dfba03bd758f992551
Sha1 84cbc7d5945334b3a59c527ce94c00753cf9453a
Sha256 3d9ac6ff03df1e10c2022b59e1834e5a24c52c5293259aaeb82f862f8082ff2b
Sha384 7f0c8aa13f9375dbeb155339a6e1db001cc7aa9f8178be011756938dcc178008ec1cf85fedc34d94e8039badcf443e4f
Sha512 7a5f1457333c5f9980de767c91b1c4f01fd8018509227facc3d617f4da08d1fccd2d5d39bc63b849c3173e326ba3d088fa226526669cf34bd03beb7884f6f16e
SSDeep 24:9cQHlR+yMq07EtKbXWDLiEqimSD4R8l/5KRYCStX:9cQfMqOUKCfiEVPHNVtX
TLSH B011A57992988CD1F806D837116F336A21379D980808A8EF675B74E76475F96F300450
7cb8d3064f4df6dfba03bd758f992551
Malicious
photov_512422260286.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_093973929130.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$q6aj6huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
7cb8d3064f4df6dfba03bd758f992551
Malicious
photov_512422260286.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_093973929130.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
7cb8d3064f4df6dfba03bd758f992551 › photov_512422260286.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$q6aj6huhuhuhuhuhuhuhuhuhuhu
7cb8d3064f4df6dfba03bd758f992551 › photov_512422260286.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙