Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 ac53ce3cf876109f7e936dd7e20eb062
Sha1 fb699cafe5b081d06ef30776686bbdbb0f777600
Sha256 c6c6cf7deb26562ac5a4dbabfde7cdf13800423b2fa6bcc3239f289895af4abd
Sha384 c60d7fd6b4d83aea05aa698f58b50d22779f865985192a666f1f34811034a82b825465158e983840cf0ee00ab6150233
Sha512 71745792ff25b044fc9a32d96d31c4fffb6a385ab3c6602f734c5fc8ff6b2b1fdba734850fdc6601963feece22e522a2adfd47325deca6c0964d64277be89646
SSDeep 24:9Qno8scTJFDuX/AOWD3m58IevTzpshmSD44PsiPtmnmnnpAVtl:9QjRD1Oe3mJyPpshPDxP7nmVX
TLSH B021677899D7FD43FC32613A1A55670A1084D43EE239BE23370E7265BA2ED801318638
ac53ce3cf876109f7e936dd7e20eb062
Malicious
photov_118296204477.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_737379023691.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$bmo0 huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
ac53ce3cf876109f7e936dd7e20eb062
Malicious
photov_118296204477.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_737379023691.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
ac53ce3cf876109f7e936dd7e20eb062 › photov_118296204477.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$bmo0 huhuhuhuhuhuhuhuhuhuhu
ac53ce3cf876109f7e936dd7e20eb062 › photov_118296204477.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙