Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 a9cc3cc79fefb6d092a554eb4190b497
Sha1 3029a7535e6818a28e205e8fee29173f6b2a31cf
Sha256 da81d29fb66af2a4b60b22945ab321d20068accf778c38971d0fbb5150c33b6b
Sha384 cb569633d6aa56d00f6d5eeb047ab3afa458db592c4e649f43b3d8da13e3a73e7c18ae621bf31d5f480b8ebe1f9bbb12
Sha512 db084bc0e79e255fe6b182bd7217ded6310d377f425808167d19953caf92c68ff3ba2b05c88538ffea21ed0ef664e44fb87eaedb2b8f7edc1fbc7654b21349a0
SSDeep 24:9jDi5mVUvN59jspb5g4fKsmktUA9Kfgi5q2SPfmSQf/MbdWqQQeSPJIy3U55PV:9Ym2vrgb54X6U8wgPnPmIWJQmNt
TLSH 91219A48CB0D6503F41205767C2FB56D12DA611493235527171C7C647EB748C27438B9
a9cc3cc79fefb6d092a554eb4190b497
Malicious
photov_202306220778.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_156340083524.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$pm1c huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
a9cc3cc79fefb6d092a554eb4190b497
Malicious
photov_202306220778.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_156340083524.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
a9cc3cc79fefb6d092a554eb4190b497 › photov_202306220778.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$pm1c huhuhuhuhuhuhuhuhuhuhu
a9cc3cc79fefb6d092a554eb4190b497 › photov_202306220778.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙