Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 b4b465ca215a1cbe44aecfd1859339d9
Sha1 f8f68b962b59caf0f4bee250e95a918981b95f22
Sha256 a850d0bc39f9aa426301d8cebc50be97b6d72aaaac9b2076f9e01f597544b31f
Sha384 a94ef8e5a2bcc8e69ce64e9bbcf15e5ba39de1d5d4bc4c195e56a5ae0c6f6665a998fc67b6d4ab1ea17dfe0fda6cdf7b
Sha512 0382abf6ce1384dde8ce4c8ae89519e064c79996491044204e767b6020aff2e1b97325329e8b20ca8470578273a6a727c21a0574aa8938cdfa852f9fed873f29
SSDeep 24:9R4Mg6cG/sd1db6ZTw0VRL+h4qMqmjKSc0wzm+CHGQy7RlA+0wz:9R4ML//s7MZTwYF+h4qMq6clx13N
TLSH CD2184DDC9C8C1B3C85FA270BA3B41A39508BA93120C347195EE32EA3AD1FC933124A4
b4b465ca215a1cbe44aecfd1859339d9
Malicious
photov_010423699475.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_384796698282.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$n0_0 huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
b4b465ca215a1cbe44aecfd1859339d9
Malicious
photov_010423699475.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_384796698282.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
b4b465ca215a1cbe44aecfd1859339d9 › photov_010423699475.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$n0_0 huhuhuhuhuhuhuhuhuhuhu
b4b465ca215a1cbe44aecfd1859339d9 › photov_010423699475.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙