Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 9c17812044592182b4a327ae2adab12a
Sha1 326652f91ec0928d674d7e78461328f82711ff09
Sha256 89a635775476cb1b86dc46a91ec337892b0dcd8bfff0734ca6fcefec5e52ad09
Sha384 2ea0d7e1e6fc41396883c2fe213035369b534028c3e5145f454ec8923a99b629bdd33568019354816b460ff59db94f4e
Sha512 f19cfca171f95d2e6e584fc0dad278d3eeade06643d5aac4541e36c0a152e73d215ced65f95c2ae240d3f629d069b60fb95fa47091cc88bacac18e70320f26f4
SSDeep 24:9LrLr6a2fDKIBNs4B+MmxAlHF8pRMDiRW+jvAPmSM+FV8uFXAeJu8:9HLr6a2fGIBNsnCHcvSPM+FbFXF
TLSH 7821BA8CC45D8CA2E40FB57B59E0B5A816132674B75053BB271D39906FCD85B2A05053
9c17812044592182b4a327ae2adab12a
Malicious
photov_511248196512.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_093441238016.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$yhrwmhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
9c17812044592182b4a327ae2adab12a
Malicious
photov_511248196512.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_093441238016.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
9c17812044592182b4a327ae2adab12a › photov_511248196512.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$yhrwmhuhuhuhuhuhuhuhuhuhuhu
9c17812044592182b4a327ae2adab12a › photov_511248196512.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙