Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 ae06f27bbc5fbaeb815a2facfc46a162
Sha1 a0d1b6d6daf6d75f92bf7862e12f5991111caf3c
Sha256 5409356095a2bc899bd31ecf5df16919a714ea1c23ebfcddc3eb6107535c0659
Sha384 96e640daa247521f41a6bdb63102b6d13022efdbc9855e211930b93b5316ce2938125952d49ea5110de38dbeb957c694
Sha512 8fb03ea5853ab451f665bbdd7b008aeb4e7a6fa6904d097d2da6e8b9c4371a4b23a919d5756cda246d872caf9e4417643830518c1a7ca42d39cf32de182a8f16
SSDeep 24:95FFajk+6pEcoRJDm7OSOyzMOYuETWsRUlD8mkAAntubjeYcZ1izDxYhdM7:9NrpORJDmiSVLxZD8TAIIbwZ1+8M7
TLSH 64218629C088C74EC0D6E23A2A193D5719126A60E002B903723AEB621B336B64721CCD
ae06f27bbc5fbaeb815a2facfc46a162
Malicious
photov_681363132992.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_334124156350.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$d284ihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
ae06f27bbc5fbaeb815a2facfc46a162
Malicious
photov_681363132992.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_334124156350.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
ae06f27bbc5fbaeb815a2facfc46a162 › photov_681363132992.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$d284ihuhuhuhuhuhuhuhuhuhuhu
ae06f27bbc5fbaeb815a2facfc46a162 › photov_681363132992.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙