Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 c8ea842fe814523fa637d0b3408fbd10
Sha1 4b03767d2aa503f191adf24d967f62ec3a492827
Sha256 31378116722a9f2b4fc03cc285af29ee76524aed1dddc46e3a2601040a1c2fb6
Sha384 4370de3404e6c251cceefc14e072de93b19ed37e9feb7143772fa649d37a43414154d32082bcad6397adfae32623e5b8
Sha512 b4e4e6bfc2d8af41978bcc106b501af95f7dedf4c0f64910856f0ec81132cdbe2b8fe4ef14481c74e6b9fa42f20a0f37de772022b1d0df4d1f62b68218a972d0
SSDeep 24:9HEZ13QnKfW7Yd3qMk5F5icHkKEImS70iQuHlzXm+5mqCOR:9Hi3QK+8d635F5iukKP7lQKzWPqr
TLSH 3121EA108713CD81D5D7E5FDA4B2074E64F09C5C792112FA231D24ED3D82ACE270CA78
c8ea842fe814523fa637d0b3408fbd10
Malicious
photov_768615723038.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_540281513868.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$frnwchuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
c8ea842fe814523fa637d0b3408fbd10
Malicious
photov_768615723038.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_540281513868.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
c8ea842fe814523fa637d0b3408fbd10 › photov_768615723038.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$frnwchuhuhuhuhuhuhuhuhuhuhu
c8ea842fe814523fa637d0b3408fbd10 › photov_768615723038.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙