Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 a416249b70390627a468ae29081b469b
Sha1 64d669f8ee3225fed43f71d8e08df2752d3259b5
Sha256 eeeeccfefa06df87ef0bfee361639661e1dc5002e5ffea3836ba01976a67a9b3
Sha384 0b800d96ee2e3168321b88718123d9012239d177a8a99bcd2c25f5631bd257fd11a227087a5c35a039f83dd0d639ca26
Sha512 2f8d94fcfb632afb704addc6135e2d02b1f0de4e68e8f8af8701619dec547af5bf903ef11edc85cb1bc58dc5cba86da6df99c215a98cfbc4a821b46fc85fc3d6
SSDeep 24:9UpxexxW97kTtCELdkrNmlBM4SFgncnTai1I5Fm0mk2jv/5cpeYUzgMp1+ehIOFR:9UpOekTtCELdaMwmi1I500TccpeY1MpH
TLSH 4821D720020A150DD0C37A70B3242D80E13BB276900ED47783B092DDBC6AEB49AD3680
a416249b70390627a468ae29081b469b
Malicious
photov_183117091485.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_424869355153.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$exe75huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
a416249b70390627a468ae29081b469b
Malicious
photov_183117091485.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_424869355153.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
a416249b70390627a468ae29081b469b › photov_183117091485.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$exe75huhuhuhuhuhuhuhuhuhuhu
a416249b70390627a468ae29081b469b › photov_183117091485.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙