Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 8f251d98e5ddc088808f3ecaf71364ea
Sha1 86db8c349a92aec75892158134906926225d99ed
Sha256 1431922cf87dd5e65476ef9975c60a7ba4f79466ff35ac16b789c62f8532eece
Sha384 6fd6baf19e4153a0d7f3d088a30939cd1954a21cd749d02d12819694e76fe4bbd08624d5a0754bad4c0e15d40a0b2602
Sha512 01ab70f3f477dc2fc23da865ce720b6145ca6e39d72d3c105641714af1b0fe6602efe931c068c38f5e9807420a984a607e15b06f917ca07c9dcbba91a4f54f7c
SSDeep 24:9zyBhHnZ7lIwGJ63fgwGxSPikdR6DQKgFmSPmq+Jl8yltYy63Ryd:9zCHZ727OgwGoPikSDQZFPF+7ltYZE
TLSH FD2171F4C01DD368C10AC5B2B7A6508C279C61D45862A40EB7B8BA83FDA59CAC71081A
8f251d98e5ddc088808f3ecaf71364ea
Malicious
photov_040252321148.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_243202559238.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$fyeqqhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
8f251d98e5ddc088808f3ecaf71364ea
Malicious
photov_040252321148.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_243202559238.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
8f251d98e5ddc088808f3ecaf71364ea › photov_040252321148.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$fyeqqhuhuhuhuhuhuhuhuhuhuhu
8f251d98e5ddc088808f3ecaf71364ea › photov_040252321148.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙