Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 ac437aef4ec19cdce5fa13dcc7b029b6
Sha1 8325c2b53e4300d5f57615f90cb3ed3f9020eea9
Sha256 9708f2b3225eccec088a0a5cdcd6adcb195a7df82ea3742744d97fc19ba79cae
Sha384 a0863536b95e0389d5f18aea47236a4480c6ac47df42746fc12f6387c4799474151916f6adf857846722638a29f0f5fd
Sha512 3f132ab76e809b81ccfc6b67446a4751ccd80afb4dc39a0aa0e74dc3cde6da954a7c6de796dea8f90bc80d75665f1325855a633cd52aed05d81c2c6c516ef665
SSDeep 24:9kJ4weFg6wbp8fE856CVWxEjr4WUjdA6h8mOk/B/Omk0XV/5cpeYy6hSKVqN9H7k:9k2weFg6wbpgE8s4jr4WGAK3OkATgncz
TLSH DF311944A321E490DE91BB38FCCE902A7017305070587AABF21CD5D38DDAF261561095
ac437aef4ec19cdce5fa13dcc7b029b6
Malicious
photov_377599207009.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_605154573018.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$zoak5huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
ac437aef4ec19cdce5fa13dcc7b029b6
Malicious
photov_377599207009.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_605154573018.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
ac437aef4ec19cdce5fa13dcc7b029b6 › photov_377599207009.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$zoak5huhuhuhuhuhuhuhuhuhuhu
ac437aef4ec19cdce5fa13dcc7b029b6 › photov_377599207009.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙