Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 a624cd5a6571ed9bfc8823be2da7ef0f
Sha1 81601c4b333ac59c8f8b521d4b346c3887fae095
Sha256 1c77cb63396a26c426c338561ac21855c986ae0fd8a201c644275296158667f9
Sha384 b025bde4282a0d15ab30229839e33455fb2fc626986a9167c8cef8266bcdac96299b8a58cbc344a9ee8ba5c4157790b0
Sha512 9fcf403241eafa69063d759c85aeb09135baec3ba286b42d0dd42888b2c463f2406a20cd9983761e2521f9f1cbd6a6e3e77342e2f6051c28216c3efbb6bcc6ec
SSDeep 24:9xOSBQVlDJdatr/Y2M+LAOLeaNiJSOcklQtmSBh0S4SUyLtyQYD5ccd//:9xHBYDra1Y2bWSOFlQtPP7PGDy+//
TLSH 6E21D7C7956BCAD8D17BBBF334486F086228B57C0104DACB21603DEC3F8B00CA326282
a624cd5a6571ed9bfc8823be2da7ef0f
Malicious
photov_273719554066.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_433986620277.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$dqrz0huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
a624cd5a6571ed9bfc8823be2da7ef0f
Malicious
photov_273719554066.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_433986620277.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
a624cd5a6571ed9bfc8823be2da7ef0f › photov_273719554066.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$dqrz0huhuhuhuhuhuhuhuhuhuhu
a624cd5a6571ed9bfc8823be2da7ef0f › photov_273719554066.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙