Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 a890dfc3358cace362996f984d139479
Sha1 6ce0f36a16e7c46d6e0df9cc3696054c3a1c8004
Sha256 b76e996dd0e2b5c8145a47b4bd5acda7d811ef8f28124e2751901b746933e5fb
Sha384 4cfdfd7debf028782815433fa001fbff4f5cf5ff541ba9640cf45fcf92658bc401de24d41f36cfa9dc7384e178989f35
Sha512 357a4cd74d839af85bec52b81d27f598804742cc97b3a675ef066becbbdc915faa4c1603c7f39caa3dd44f4e1da38c30b74ccbaaf677e393fcf98fce5907e398
SSDeep 24:9kPX+Mr79k4xWCRS5H5MxQgSK9IDplmSbh6Q6egj6jKwpUW:9kPPdk4xbRS5HiuIqfPFRbWwv
TLSH 3511B50490A68B91CA7BE07BFC63457D45201A724004A0A1292C61FB795FFEC9BD34BC
a890dfc3358cace362996f984d139479
Malicious
photov_062776929150.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_276546463587.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$y10hjhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
a890dfc3358cace362996f984d139479
Malicious
photov_062776929150.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_276546463587.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
a890dfc3358cace362996f984d139479 › photov_062776929150.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$y10hjhuhuhuhuhuhuhuhuhuhuhu
a890dfc3358cace362996f984d139479 › photov_062776929150.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙