Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 85717735af709f1b38c5f33bbf12177b
Sha1 280066b48e0c94530614c66e24da2c743bbcfab0
Sha256 e996cfdad8da2c623d24005b615276179f74b64a0cc3ff1e0de40f73e6ff8ce0
Sha384 ed3f5addb2b4e16817fffc0350b4bb02f20ea1c7dd1617254f03fdd28ff9c764d7493e997148881dc2ad3737820de323
Sha512 baee0be67383d98560bba0d458b17d9f38b3212e660db485c43e986dcbcad622033e35faa5cfa4582b1dc976fcd2d03df890f00a98e5fe852fba44ea9024d9ff
SSDeep 24:9rVQQWvmDIQNqEshGDDsLFLzlOBUPja167CwF4l+d4KYmk0TbvAxkLGiBeR4KT:9rP9iODwZjB7CipXYT0Tr1LGiqXT
TLSH A121C850DAEDC758C5E35636F8360AAC3460A1154605CBEA775A8A4EB459208920BE3E
85717735af709f1b38c5f33bbf12177b
Malicious
photov_961998800370.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_993170888983.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$jhf0jhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
85717735af709f1b38c5f33bbf12177b
Malicious
photov_961998800370.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_993170888983.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
85717735af709f1b38c5f33bbf12177b › photov_961998800370.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$jhf0jhuhuhuhuhuhuhuhuhuhuhu
85717735af709f1b38c5f33bbf12177b › photov_961998800370.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙