Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 a7c07eb06caee53f38f9a8fad22c8f8c
Sha1 2965f7686616ca64c445873d84305f9661fce845
Sha256 dfc8cd0674a378ded4d6de7feaed43f81d880b8ba6e13b3f9114ad4a052f56ed
Sha384 5cd4e2d17e46cb2c61f04e246c9cebc29bfa0d61a445f8a3d04efda47f46b1912cc41d250274759fc4d24e13fcdf2c18
Sha512 3febed76d2143c29eaff3d5246a8e366e2d39962058522c1f5ccc8a12322f6f40263b69902f24ee1ef2a556b76a844e76fd40a2812629d8ace2433a363d26efc
SSDeep 24:9it4dt7SYdZeptWWY6CTRSQk3TtNzQtSkXHt7mPDJ4mkEXBAxoqptdnYWLk:9wm7DqiHjkzz0SYlmPDJ4TEXBCP/Lk
TLSH 5F21C8C0007FAF94C8629B367C162D349E96DD4D936EC3071FF471E49612ACADB02AC4
a7c07eb06caee53f38f9a8fad22c8f8c
Malicious
photov_095048111801.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_821127614631.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$pgnwuhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
a7c07eb06caee53f38f9a8fad22c8f8c
Malicious
photov_095048111801.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_821127614631.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
a7c07eb06caee53f38f9a8fad22c8f8c › photov_095048111801.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$pgnwuhuhuhuhuhuhuhuhuhuhuhu
a7c07eb06caee53f38f9a8fad22c8f8c › photov_095048111801.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙