Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 8dde98b1bf00e61cb92c0e8dc4ab2796
Sha1 8e82a7ce6be011eedad96a8b8c2432cbd5c9f0fa
Sha256 d8d3350c0a33efd5d93355091fc9fdb83573f9ba640cbca79c38f235d0deedb1
Sha384 33a42e469ce269822c7f226252fa5e37412446766ad7f55e01020676248df46bbed4054de462e8f7d4728fd88272493e
Sha512 30aedf71ef72932b4af5a5091a943f7fb66ff74331f9ad4157d759162208626930192ff20834ad00f1a8ca204547a545ea47b2bb2657366822a2b6a683f0a014
SSDeep 24:9iL534ezCpjWNhmkF2xzJ6PWP+6wLSuhTmSya4JMgW+Iqn9haflULlI0L:9Le4jI1eYN6wXTPHq7afj0L
TLSH 2921C801D42BFEA3C81EF1361A9C2F3645135098108D42B6F12854BBF7B6ED663A87A8
8dde98b1bf00e61cb92c0e8dc4ab2796
Malicious
photov_763696125571.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_651610412409.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$qqt3yhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
8dde98b1bf00e61cb92c0e8dc4ab2796
Malicious
photov_763696125571.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_651610412409.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
8dde98b1bf00e61cb92c0e8dc4ab2796 › photov_763696125571.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$qqt3yhuhuhuhuhuhuhuhuhuhuhu
8dde98b1bf00e61cb92c0e8dc4ab2796 › photov_763696125571.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙