Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 b8ea75d9e6c00dd1713c955ef8ef95e1
Sha1 7e37a194adc41402e58f3579224bc13c72ecd6db
Sha256 c8e58f7fa40cf7bf57fd637b02bfb8d4369f5168d3871e1a192b4c622f8a8fcf
Sha384 970794281ff3d0fcc99e8825071bbeeee3c043e5fbf56f186ab5747b2ea269aec0e98df35d9934bfd4c02f270f640b22
Sha512 018f3c45fe869cb5a67673e516e05d06b0c37a6f8d6f9227ed9b65ab2e8d18348ab5184718dcdeb17829afd301f363467a03872e994df8edf49599c6ff2faab3
SSDeep 24:9k2lyNr6Ks4ji/WE02gBOm55ZmSPhGY7+Ew/23+95Sxml:9Ep3jvHZPpGY7zlxml
TLSH 95118638D01DCDC4C8D78476A97726AE256120828A27681E034369BC7DF399DAB004F9
b8ea75d9e6c00dd1713c955ef8ef95e1
Malicious
photov_416471674203.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_990845087709.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$d4gr6huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
b8ea75d9e6c00dd1713c955ef8ef95e1
Malicious
photov_416471674203.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_990845087709.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
b8ea75d9e6c00dd1713c955ef8ef95e1 › photov_416471674203.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$d4gr6huhuhuhuhuhuhuhuhuhuhu
b8ea75d9e6c00dd1713c955ef8ef95e1 › photov_416471674203.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙