Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 c64df55843cedd2021cb85b712f4e936
Sha1 6d5e93b535461b910f3e2d48604ee4e632d43f64
Sha256 e315a4d4ad672553dd44b71f2bbcb3cf3e662fe63e0debcdaf87b8dae64d4868
Sha384 911d906f8552e586f4540ddef6a2f377f8b6845b86b63bf4735cb005978509603818055fedfbb3c678b459503c4fda8e
Sha512 8fbf46e761a6b397d2ceb415d085199929dfd8bc175ed52087aef4d92de16d91f6b2dbdfefc5eedc8d4d7604a4492fe30c74fbbc726d29b458a0563fab74650d
SSDeep 24:9c89bu2dtWyjD10XZzrpAm//+25l+CYDAXmSX5hDY7JYu2vOdS1ChPOIVX:9c8QW8yjp0Jz6mn+K+CYEXPXXDY7JYuB
TLSH 7F21B75E64F8ACD5C6C8E63E787D4E8CF702F9A08013580B035419B67D07E97B711584
c64df55843cedd2021cb85b712f4e936
Malicious
photov_734341042366.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_203558780014.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$j1r1xhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
c64df55843cedd2021cb85b712f4e936
Malicious
photov_734341042366.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_203558780014.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
c64df55843cedd2021cb85b712f4e936 › photov_734341042366.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$j1r1xhuhuhuhuhuhuhuhuhuhuhu
c64df55843cedd2021cb85b712f4e936 › photov_734341042366.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙