Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 96d1a7b830c6bef76a2b5e3c34094746
Sha1 1c1ebfbcf3591ebeef6ba858206a038608d4e5aa
Sha256 762db662ed65d34830b16e15767c05fbb1ccf19255e9b7d691549aa6cb60fd14
Sha384 dec0ccdb4f490d12bab91c182dad584296eec9ee2ae21313e02da77718c6438447dad54f77bee4e22ae1d8bb8572e3f0
Sha512 2fa86c693181629c277f714ad5e3a14091cd058e96ace3c6ddaa7318f166af6f7d3eb62fc5816cb3962992d5e3e1e108cd0d6a0774f190e8ca22271d4210da78
SSDeep 24:9RVXMWdtLmL7mlwLaRlwI2uwrq6mkKzMhNmW8xjUsRRrp+//:9R5MW/L07mDwrq6TK8NDujlE//
TLSH 7521E77C8A1DE231C29EE53580631F481A5C0051A632824ECE69AF2AFE46E644B410BF
96d1a7b830c6bef76a2b5e3c34094746
Malicious
photov_916855168558.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_412902320920.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$s3t9dhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
96d1a7b830c6bef76a2b5e3c34094746
Malicious
photov_916855168558.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_412902320920.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
96d1a7b830c6bef76a2b5e3c34094746 › photov_916855168558.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$s3t9dhuhuhuhuhuhuhuhuhuhuhu
96d1a7b830c6bef76a2b5e3c34094746 › photov_916855168558.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙