Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 99ab1b572ec8fdc79d7b432c8d15b5e3
Sha1 08a5b7c5a91e1f416edf86bb90719201c2b428be
Sha256 abe58173e4e6f99297f8f031252eeabc2af18d795dcaa4e8c826265a691306a9
Sha384 08cd9ea9dac0d16c7d09abca4c0641ee9cc175cd0689e08e1c87b0c1c55d3e06bea5311d5210a8e0a65fac0373e651a6
Sha512 629278a4d5397b67a052f50d447fe0147d4c5811a63c7da25516fb6f3dd378768d6c45ddbaf0aa82d56a41b28637b0ad884c721fd67387180fa49b1e7057ea06
SSDeep 24:9LoQ2e8urxGb9OCUZJCnBWtbwU2dEVE6kmSegi+gWq/R3QM:9LopylGxtUJOjtGV3kPe5+gW+n
TLSH CF2166D968C61A67E9DB66373E826235BE86617E26B08171861531837515C800B4C9DA
99ab1b572ec8fdc79d7b432c8d15b5e3
Malicious
photov_925905291378.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_720204590557.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$wqg3xhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
99ab1b572ec8fdc79d7b432c8d15b5e3
Malicious
photov_925905291378.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_720204590557.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
99ab1b572ec8fdc79d7b432c8d15b5e3 › photov_925905291378.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$wqg3xhuhuhuhuhuhuhuhuhuhuhu
99ab1b572ec8fdc79d7b432c8d15b5e3 › photov_925905291378.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙