Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 7e4cf1d4518ff9b5f606f3200c35eefc
Sha1 0bd01b874a725b2cdefa6ca537e11fbd603afe9e
Sha256 07146ca82b6f4867862b4d74a8169360d01204151d9070853abf7da636d944b4
Sha384 2132f1b091a006ef4f1a85a09682dbc5c79ddbcb00b1966c662c5d9e7e7808bb7b9346909133c4d3a667c18858f99179
Sha512 9569dbbf6792acbae6fefb5283514f6ad7557716658ec0d73a16a771925cd54d623075dea3de27d1ae8d51c574a2e2deead4cd82318343f5a24b9549c8ebcbfc
SSDeep 24:9eBNzsQ3MEs7qw1dwFJL8cqHoio5aDLrauNwCmSvlbdWqSxAN/qN/:9eXsm+/dC8Zfgazau6CPvTWlyNK
TLSH D221B4D185AD8310CC2B153F38889E89188472A9F2440AE2727FA98C1F736A85300CA2
7e4cf1d4518ff9b5f606f3200c35eefc
Malicious
photov_457828597195.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_789160557678.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$ztzj huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
7e4cf1d4518ff9b5f606f3200c35eefc
Malicious
photov_457828597195.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_789160557678.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
7e4cf1d4518ff9b5f606f3200c35eefc › photov_457828597195.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$ztzj huhuhuhuhuhuhuhuhuhuhu
7e4cf1d4518ff9b5f606f3200c35eefc › photov_457828597195.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙