Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 b4a72c3b2a2addfcc5dc56c13601c0be
Sha1 5edca41a51bbacf2a5bf048f82e65c919eafba56
Sha256 7d85ed9fb87c23f6d1a638b99d19265bd30bf981277d4fdbc3cfc3e5c3e0081b
Sha384 54d8b5d05deb376299706c5172ed57e00e7c357bcbf9372d2135a7be15ed647325c99d925b8e31816077dfaed449d2d2
Sha512 4e051b3c8014f47b5bf06ce59b7f3a00d4770830e61c80e9dbb3bd05a277f45f07e3ab077e6a1457971aecf7e89ffdc7511db5fc37d49ee376a23cb949e35122
SSDeep 24:9DPiA1Mx5S1X2TT53BEt9GqxF+pZIwmS6QplLuWhfd+pzOIK:9DF1Mx01X4nO9GqX+fJP6oXl+hOb
TLSH 04119427B842C0E8CD5FCB77B88992C82965E09C3FD1DB8B439A35C77D595A2634A2C4
b4a72c3b2a2addfcc5dc56c13601c0be
Malicious
photov_909683014997.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_892807855142.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$a72x6huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
b4a72c3b2a2addfcc5dc56c13601c0be
Malicious
photov_909683014997.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_892807855142.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
b4a72c3b2a2addfcc5dc56c13601c0be › photov_909683014997.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$a72x6huhuhuhuhuhuhuhuhuhuhu
b4a72c3b2a2addfcc5dc56c13601c0be › photov_909683014997.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙