Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 8bf05ae203fee79d3b369ab86284f4c6
Sha1 c43282f448e693d5d5d7d9649a23b49ab979d332
Sha256 3ebf53b08ba2da74aa9662829c293fae86abd7891ca66cbdee1776cace77e89e
Sha384 beb723ddf9737202809d7515388ad273889115db7c26dd65de1b057607060b4bdb0c267cfff1fc41dbc8e80b4b846f3d
Sha512 973a8f320d170ffea6f7f46e4e0c5782ca826ef27c4e31d1e8b3628e7820af85954a3211a26984fa3bdfe8758cf01373ec7f83c086d3cde6aabb38d8cc8c21c9
SSDeep 24:9cfcfCFDBPVhjDKjmQW/jTl9KFJYur3kwOTKmSwX24JxMlffL9fCMbwOcAX6t:9oJTum/FqYEUTKPwXNMl7jX+
TLSH A221B950C929136EFA01C4B767311F2A7045634504AE78F8B5D46E84757DFCC7F964D4
8bf05ae203fee79d3b369ab86284f4c6
Malicious
photov_711408659490.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_436452610614.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$gzum3huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
8bf05ae203fee79d3b369ab86284f4c6
Malicious
photov_711408659490.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_436452610614.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
8bf05ae203fee79d3b369ab86284f4c6 › photov_711408659490.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$gzum3huhuhuhuhuhuhuhuhuhuhu
8bf05ae203fee79d3b369ab86284f4c6 › photov_711408659490.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙