Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 ac877f1aaf489bf21076652745ccb6fe
Sha1 3ad3768574a2e3dcb037811b041d05bd22c39e18
Sha256 65a8f831e009188555486aae3544cdc71bb4669d132d9a3314dbc7b31b8d8932
Sha384 7ee0854d82bcdf4b57383e433e87de0a96c72e4fb81dab692c50c3741b01a7360f1ea6687368885b4596a2983ac54087
Sha512 8e77a890dd492c847c0a8609ecee9c81cf985b8a6f60e9138193a931d035bd6debc82212e6a3e2e765ea10c8e8164e1b3b2320c57def71f74e259568ee88e8d3
SSDeep 48:9fCzOw9c8EWVRz+Vxe799V7TsQl+AQj7M:W9cHa+a7NIQl+AQE
TLSH A431C930C1DEEF50D6E7B234FE6E094A30B2C72B965A8227A67CD6C7575201C0742B1C
ac877f1aaf489bf21076652745ccb6fe
Malicious
photov_027938430949.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_310379248880.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$vxlmehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
ac877f1aaf489bf21076652745ccb6fe
Malicious
photov_027938430949.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_310379248880.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
ac877f1aaf489bf21076652745ccb6fe › photov_027938430949.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$vxlmehuhuhuhuhuhuhuhuhuhuhu
ac877f1aaf489bf21076652745ccb6fe › photov_027938430949.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙