Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 ba0e6b2803470a769a0fbbcef4e0902e
Sha1 a5f9ab3ef7a293440d572782c1753f60e28ed8ca
Sha256 48a34014da3a472c643e06a8036d5e7daf3ed1a89b4f23a6570a5ba8eddcc337
Sha384 83eb5db7fc0454a73870a50337fe24711285265eaf7975ed5e9d282959527a3599eca89bb10e9b25effd7cf894c9c5fd
Sha512 504a9d044670741316d1eb57317ebc95cfa7785f0418ae4775c2356f89cf52f234a95f6db3e2ab6100cfc99fef31aacc7d263621d3b7192e0101ea4b2615a386
SSDeep 24:99z3mAICd5bOazxZpKlONbqTV+sTUSeBciNqL8PhgBT+mSGphDY7gojzCBgApTbX:913D1L1bqTgsYBuiQwgcPGnDY7gonGPd
TLSH D021CAD0F6554C02E58C933BB602DD4C255DD23A944ADEA7C30D32B66D53E683E0BAD8
ba0e6b2803470a769a0fbbcef4e0902e
Malicious
photov_772758764440.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_787634719105.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$cb7drhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
ba0e6b2803470a769a0fbbcef4e0902e
Malicious
photov_772758764440.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_787634719105.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
ba0e6b2803470a769a0fbbcef4e0902e › photov_772758764440.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$cb7drhuhuhuhuhuhuhuhuhuhuhu
ba0e6b2803470a769a0fbbcef4e0902e › photov_772758764440.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙