Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 b98457c1194a7daf57f44a9f85fff66b
Sha1 8ed537d92dd12ad15e1dbd664bda422aeb24edfa
Sha256 082aa37b35e1fd7b851a833f7abec75f2cd924993cdb5ad63044cc7a93116c92
Sha384 12e852adf05fc71d27b2f25958c2b9c8a9125d100ed64fd8f92b358120f9249e3afbaef3003de2b36efa8bf267c9b274
Sha512 bb1a29ff8520ea0cd45d184833c17300f03887b828653c9e3b3c08cac6f8410eef31a498c2617f1fa17c1bcd3763d5c9cd2e4a56ec9c329d2b816b3eb21ec8e2
SSDeep 24:9jkzVZduzBTMb0pU1Q1FXt9+6blqbHLQPmSBL2hheY7t1zc2t9lpfWZ:9jkzTd0zquqXQPPF+heY7t1z195WZ
TLSH 5F21740CD1649586D6C1CD73B007CE1776F0C922A58613127F543A3B2FAAFBDDB1A89A
b98457c1194a7daf57f44a9f85fff66b
Malicious
photov_669209540645.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_709724926989.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$vjd5ahuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
b98457c1194a7daf57f44a9f85fff66b
Malicious
photov_669209540645.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_709724926989.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
b98457c1194a7daf57f44a9f85fff66b › photov_669209540645.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$vjd5ahuhuhuhuhuhuhuhuhuhuhu
b98457c1194a7daf57f44a9f85fff66b › photov_669209540645.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙