Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 b6dd10e161aa17bb9abe68d508f427fb
Sha1 a1a0acf26b3f793009069baa4e1145c4f1f95f67
Sha256 7772db3f5485066f41830ec76a1b1452566f79a42659f3cdf445eab0593d9518
Sha384 6c38f8e8efe5bf765544e34b353152ac50e75b323ba202cea731701d479b45e083209efc3afcc5e89cffb0d80b0c3eab
Sha512 ca868c737ff3c42131f2315f495585ff19d570b7cd85a3489647f70017b28a6a884d23adc0aef4ded79567a92d93116a60d864ad5670d8b7005e076653ff89a4
SSDeep 24:9XhkIxASCdTUWDtqVMWqMESzvIgGck/Q18PJHSOypmk/H+UaNuUamv4XR7vuqBfh:9RZxHCdTUWJqlqRSzIP/Q18Pp8T/H+UD
TLSH 5E31C932D649C1F6FB0DD234F45E02CF21A55078D543985782511C6E3A1F6A134C6C1D
b6dd10e161aa17bb9abe68d508f427fb
Malicious
photov_933994967404.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_744422916144.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$v6b75huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
b6dd10e161aa17bb9abe68d508f427fb
Malicious
photov_933994967404.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_744422916144.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
b6dd10e161aa17bb9abe68d508f427fb › photov_933994967404.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$v6b75huhuhuhuhuhuhuhuhuhuhu
b6dd10e161aa17bb9abe68d508f427fb › photov_933994967404.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙