Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 b1aed4a2d8b219379972cb3293a5fbfe
Sha1 75bd1481c9996981151c181580a8e84ce62b7541
Sha256 3debdd47c84ecaa2b07e41c5db24fb9dd071bbc0db04abdffa6fb64f65f7b89c
Sha384 33b5024dea784cc3e876999f5abfb6fafc3363f7693e1457ad000033199a1fcefc2bbffb4fc8649295d4237c6f606819
Sha512 44638edfa30fec77d792b8d65681a733a8581ade5e51a5b85a4250f1f9e83d3e43fcce391e0c9f0f910633aba41d91f2417933973722a2516569a669a35623a7
SSDeep 24:9xpcPYg3VYDl0Rkfc+TlzmSynWhheY7J3qe1tbKrK:9xpcgg3VY2uPVheY7J3Pd
TLSH 0321B7BB9539D90DCA9A837135464BC9C973ECB0B1114189115C3DA6BD10FB4FB9B5B0
b1aed4a2d8b219379972cb3293a5fbfe
Malicious
photov_152822937441.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_422692195713.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$oobf6huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
b1aed4a2d8b219379972cb3293a5fbfe
Malicious
photov_152822937441.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_422692195713.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
b1aed4a2d8b219379972cb3293a5fbfe › photov_152822937441.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$oobf6huhuhuhuhuhuhuhuhuhuhu
b1aed4a2d8b219379972cb3293a5fbfe › photov_152822937441.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙