Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 ad4a780b03798952035137306e48d5a9
Sha1 d9a5fbff8275823997998605d74fd783d5a5c132
Sha256 41ff02a13f17fb28f4efd444df660ab079873c9fc90b95a57a3526fd057f1130
Sha384 5d8b912cad98b8726faf0a4d3df2c461f7f863c6df14101730e87e2d25f050ef1580b8f495bb5073e1b4add9ca72fa51
Sha512 26965ab00be4c00625d62901ee584a37639e58b1cbbfb567e8811b7cf9b215c63417fe1f30badd079bd3d385923c6820e051aec6056be80a0c73f4068f43a36a
SSDeep 24:9cEM4VIBoNAG5BLl2/SA7IGmSjbpWqLR6caYhwAaGOw:9cpo+6B+5XPpWGR46SGD
TLSH 6321A5299D11CB20F829C0F34CA3D970E276EB0F824461BBA2A41C287CBD96D3352089
ad4a780b03798952035137306e48d5a9
Malicious
photov_110491754455.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_032384297840.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$yz7e4huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
ad4a780b03798952035137306e48d5a9
Malicious
photov_110491754455.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_032384297840.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
ad4a780b03798952035137306e48d5a9 › photov_110491754455.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$yz7e4huhuhuhuhuhuhuhuhuhuhu
ad4a780b03798952035137306e48d5a9 › photov_110491754455.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙