Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 bf2455bd53f652b37122760bd4ed01af
Sha1 ec31da4024d100898aecf3308d40696c055dd237
Sha256 954f528dcb907ea1637accc6dbc5fc5f26313bf7c05bf107883e79635c5dac4b
Sha384 29037fce883e863bb61e362dad78bd11d2b9f4c1a264d26e47134d3e6f5b75a5e730419e348163dae9432eeb3e3c2412
Sha512 c68bb2477fd52d60a962a9157b937b3822a116f64d51008a9943eed8d5e961b826795c26ada8f7e97de44a0d581c4b454f12ba3c9f1e3c729017112a6f19cac2
SSDeep 24:9g3r/y059zCPmpi9uFWVeo/2i1Da9TBtLJiqDXJqmSeqv/UJJxaM5pWAtF:9gbf9zOmpUCWVeo/4T/L8PekUR
TLSH E821A32080D8ED00CCCDD6325B47628AB71316B1F3A943232B912F9F3618B8D5B553B9
bf2455bd53f652b37122760bd4ed01af
Malicious
photov_471141756376.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_664126069446.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$yxaz9huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
bf2455bd53f652b37122760bd4ed01af
Malicious
photov_471141756376.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_664126069446.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
bf2455bd53f652b37122760bd4ed01af › photov_471141756376.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$yxaz9huhuhuhuhuhuhuhuhuhuhu
bf2455bd53f652b37122760bd4ed01af › photov_471141756376.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙