Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 b29f7ec6761d11a4a08f4a68c303e118
Sha1 9e4a56b00843990ef00e23332bf06442f92a07d6
Sha256 b6f8fc817e686412f59af1523e5db0dde36a583a6fcafde96356998a2628bf50
Sha384 4d5f4693dffba118e8ced74f66b43336fc2caad0dc21f4ca7655b53972c58083b84e07e3f4ff075e38378a6c28e4b13b
Sha512 ca2d7cbd75181a0c5798f3aa56535d2f162287a655759ed4f533496cba8f4df2b0cf7057d803c5fe5cabaa6d67a510f1f268809fa8be4d4bfa75aa8a6fc7aa30
SSDeep 24:9/8lC9AUIQMGD/1AKZbcKJdrbcgiTjYRkVWmkjrMhrwUECf5I8SdkDAx4QI2:9EYP5j1lHJbc1VWTYDp58kDAxZ
TLSH E331C9F1C3D27A60C51B82F8A8A8F58AB7578518423F45135DDFC5819D4EDC893CA1A0
b29f7ec6761d11a4a08f4a68c303e118
Malicious
photov_169890953939.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_563407391132.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$xj3t6huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
b29f7ec6761d11a4a08f4a68c303e118
Malicious
photov_169890953939.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_563407391132.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
b29f7ec6761d11a4a08f4a68c303e118 › photov_169890953939.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$xj3t6huhuhuhuhuhuhuhuhuhuhu
b29f7ec6761d11a4a08f4a68c303e118 › photov_169890953939.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙