Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 875a418091e9caaff7f40210e9778ea6
Sha1 bc595c83dae4eb0b0140d1dfde3408864068487a
Sha256 79e58c65c58dcec7bc58c988399dcb096832af423d8a4f55d9fddd24f06b420b
Sha384 2ec1f2960c1c7ab84237482b20b0ca4692cc506e67fb941adbbe396aa5af918df0e922a87e9354cd3ef33fa7a6279c5e
Sha512 681cbb689c444d6fcbf78619b9b2ff8d93732cb47e35e3283fa9692d840c0f0f183594b07b64c56bd5070de081ad3c02d1bb952bdbd72b500925b6d45da11fcd
SSDeep 24:9yPdm1BZ3jXeECANvD0I3Xz1mD4bkmS/AplLuSXtJJ9x2XP17mh40:9yPAfZ3juaRr5mD4gPQ9XtJJ6Pdmh40
TLSH 752184F88316AD6CD70081355E94956926658494B406A2DF0EBBEF8EE4B192CA7463C1
875a418091e9caaff7f40210e9778ea6
Malicious
photov_194689927276.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_854629816221.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$ibi9_huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
875a418091e9caaff7f40210e9778ea6
Malicious
photov_194689927276.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_854629816221.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
875a418091e9caaff7f40210e9778ea6 › photov_194689927276.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$ibi9_huhuhuhuhuhuhuhuhuhuhu
875a418091e9caaff7f40210e9778ea6 › photov_194689927276.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙