Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 96611980f22107cb8ee74144c945dbf6
Sha1 baebe3862696e4847ad892a3a57ff44b81e7e2aa
Sha256 a2e0826bf52900d8908ee471b9eadd84304b2319bb66a31bf1713fae4f4affea
Sha384 e1dea6c782c8d45bee909a22018d81586fd9e86758d73fc8b5ef39089cdd503be78755115c93d337ba7ff4db3ea89df2
Sha512 332891796e258c041cca45d1e240c1e054b682b7325427ac374aaa72b27c13145c898f5d90fd05f4212d4cfe0438852eabf63aad4671b4684da1401d8af78462
SSDeep 24:9tfWpWv5t5lsgZIDVTJbVRgEA8K2OumSBlLuSBmSSDiotY0QfnhpaOP:9tfWpWBPlLmJxjDhPfHBmSSWotYFfhpj
TLSH AA21B4A9C8078507C6DB697B3C767408522D2A37DD90209F6BE6989F22031D30F4AB60
96611980f22107cb8ee74144c945dbf6
Malicious
photov_501602830992.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_416991175136.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$d6af huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
96611980f22107cb8ee74144c945dbf6
Malicious
photov_501602830992.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_416991175136.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
96611980f22107cb8ee74144c945dbf6 › photov_501602830992.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$d6af huhuhuhuhuhuhuhuhuhuhu
96611980f22107cb8ee74144c945dbf6 › photov_501602830992.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙