Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 bece008c345370143911f37435fc2ad8
Sha1 3c6363430d59264fc924efa1369f9144a944b373
Sha256 ff29183d83b5e1da9cc2effebc90676fd3f5db446318c36c10439f8a530b77fb
Sha384 a30f20be37d27268634a6f056a53654112debf9160fa064655db3efb0bf290cbf36d1f3b83f59316dafe957140e2cc87
Sha512 1b8cdc328030b963f5202e206c3af93deee450155aeac1ea8fad33884b27251aeefee9e7bef3ef08c1d52d72cbf600e71a0128abd073efd96c8ec3e96874c4b5
SSDeep 24:98dWHpjt8Zn4ImvNQ7fqHJNU5myQWOIXfTmSjQox8fLk1OvWIXKpi:98MpjqZ41NyyyQtI7P3kqq9
TLSH 5D21A77EA1A2EC06D0668336281256C6D10B07502621B6F7B279EFA539E41B5D37CB63
bece008c345370143911f37435fc2ad8
Malicious
photov_123012156647.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_645362068879.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$qw72uhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
bece008c345370143911f37435fc2ad8
Malicious
photov_123012156647.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_645362068879.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
bece008c345370143911f37435fc2ad8 › photov_123012156647.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$qw72uhuhuhuhuhuhuhuhuhuhuhu
bece008c345370143911f37435fc2ad8 › photov_123012156647.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙