Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 c3eefecddafe3be97840897abea7f57c
Sha1 a76693c1dfd0ff63d2dd36b9c911b9c550f08657
Sha256 33ddc013bc2da8877d129f1a617558fad621c222ed10a1dd157bc4daa948050a
Sha384 1dce625f0663050e9d217631498a9555570e8ef64cd855bba401db0bfcb393367575cbca5350079f45d2ce382a98ed4e
Sha512 0ceeb0c5b8211bb879a32b27c7d5149172a32c392b3588d8e1ec51798744f0ecdc12b4c90636e9c96c29e98b56b8a93f22f9943aaca5744b54ccfbf7a24e5187
SSDeep 24:9bv0CQtJuqiCwlyjGoVU9nZFPp3NuLD0mSvu+uQ8ERv61DK:9bv0CVjKU9nZFPr+YPvu+pvMu
TLSH 0311355091DA45D2CC07C6F1BA6B2BE2622D1141951561DB2FE359C52C837E873654C0
c3eefecddafe3be97840897abea7f57c
Malicious
photov_143988352124.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_386752776228.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$k3886huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
c3eefecddafe3be97840897abea7f57c
Malicious
photov_143988352124.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_386752776228.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
c3eefecddafe3be97840897abea7f57c › photov_143988352124.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$k3886huhuhuhuhuhuhuhuhuhuhu
c3eefecddafe3be97840897abea7f57c › photov_143988352124.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙