Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 8f8fc17c5856bd3b46b4d9248d9704aa
Sha1 3ea6fbc26c77695702bd79599285c53e3e44441d
Sha256 f356d45aeff316f6edc1efe417c8ec816f718f13d6bcc8d94292d10f2963ac13
Sha384 bf1715d8252bd00d8270672d15d013fa1cc0b8297d1e181e63330fe705499d169936467d66ee7aed9d28abad97c10d89
Sha512 23f93d7f8caafbeab5aeca8b60c1f5f6735d0dc841c48566ff42be001d5ef221f66032aecae1f56609b14fe52b52c0b387819b72eb922f1dd4032bfde35a6788
SSDeep 24:9n7XfIg77E0ncERXeQbSvK1rnhPJgmSKghGY7XMXD9BKxhQbJptl:97XQ7/QWvK1rhPJgPKMGY78Da6J5
TLSH 0B21966C20E888C6C7CAD1356C4FEE7116118014D8C7BA4216932BFA3C03295A7BA6AC
8f8fc17c5856bd3b46b4d9248d9704aa
Malicious
photov_572044780860.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_078730890436.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$jkmpqhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
8f8fc17c5856bd3b46b4d9248d9704aa
Malicious
photov_572044780860.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_078730890436.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
8f8fc17c5856bd3b46b4d9248d9704aa › photov_572044780860.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$jkmpqhuhuhuhuhuhuhuhuhuhuhu
8f8fc17c5856bd3b46b4d9248d9704aa › photov_572044780860.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙