Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 984438987a9a84da25fcc5b477cdb3e0
Sha1 e99b769a7a1dfd49232dbc469e5ca714223c324b
Sha256 47cae4804d625e4bfd1c502970162826443f153c20d60f158610cb8ae52aa712
Sha384 8852ccf2db0bf5d56158faaccfca9fade60d9c4f7e2353f3e96c9277905ce661779bcbbb4f624828f5b93339e38ae04f
Sha512 ca22fda93da3420fd6d4d90c8c17472be4080fd386c17995a2505e74d3dc6712e820e3dfd24fded330407a3c48c6c030c665c32f51d8e9399480d86b7a2464cc
SSDeep 24:9vO6dp09008RF3GM1ILiSoGeuQ+f4mS3yxMrS7Q6yetQfd:9gOF3GCSKP9O7M
TLSH 9421CD469083C00CDC4D8D726DBAC501B3343E5975D6F34B4DD435E6B498BCC9F04484
984438987a9a84da25fcc5b477cdb3e0
Malicious
photov_142177907826.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_358424753532.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$ghqmhhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
984438987a9a84da25fcc5b477cdb3e0
Malicious
photov_142177907826.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_358424753532.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
984438987a9a84da25fcc5b477cdb3e0 › photov_142177907826.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$ghqmhhuhuhuhuhuhuhuhuhuhuhu
984438987a9a84da25fcc5b477cdb3e0 › photov_142177907826.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙