Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 878e4fea4fa330b38e991f2b1d1e4a4f
Sha1 30b929795440c24991309e76c87646b58e85d019
Sha256 58b863840db9aa4883e287502641409ddd1144038ff8717de984d60831bcf314
Sha384 f2f0a2be3fad49439ad716ef927f1e1a47e1ce7617bd8f635159f5f023f6b55c1c4ef096da02627302a1088ccc34fe6c
Sha512 19ec4785703fbabe785a65b00de029bdd0492b5e5b2e2408815b6d93b59197a12f15140e02aea42cf1eb1870688e1bcdf21881f0a54ba62d4f55bd86f5b78aa2
SSDeep 24:94cuQ2Cxk1SLDTh1Go7Uje8xcSSyoHgdh5JAzZmSRWhheY7IE/Vfcuevql:94coOHh1hAzcSSnibJAzZPUheY71/Rcc
TLSH D0110C1488BBC2ADF9D7A732F9451CD93513311A800123B71343E5EF2E09D631F02385
878e4fea4fa330b38e991f2b1d1e4a4f
Malicious
photov_004120339608.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_895899260599.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$lhmvbhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
878e4fea4fa330b38e991f2b1d1e4a4f
Malicious
photov_004120339608.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_895899260599.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
878e4fea4fa330b38e991f2b1d1e4a4f › photov_004120339608.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$lhmvbhuhuhuhuhuhuhuhuhuhuhu
878e4fea4fa330b38e991f2b1d1e4a4f › photov_004120339608.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙