Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 cb837f1c643756a6162dcbfd1dc124e6
Sha1 e5fa2a58fef882e8a2f6bc6b783552679ce78505
Sha256 267c933cf079155fbc54d217b9acca3f65db343ca03fe8f6e05f607c548c5138
Sha384 a9d29acec02293e281254f88c9bed94d13ae6aeee425216cb36a8e727d52f455cdabecbcdee972e880c348ae3e515be6
Sha512 f9d4671639fe23d1aa0dd46c8f013b8a33b47d079912329ed07ac3973941f3a71138485ef3337a341aa28d6dc9114af5d356316860b24790e60c316bb17e54bd
SSDeep 24:9rcbdNSvNkOdtUWfmwt6kOYVmgmShqH0Sv46ZqVmr:9OGvNkWJfzdVtPkLQVW
TLSH F711750DA6DA82D3C88B85F67A3694858328DCD43152F0BD630E71946EABE741B241A2
cb837f1c643756a6162dcbfd1dc124e6
Malicious
photov_166169748705.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_887420520215.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$ukrzzhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
cb837f1c643756a6162dcbfd1dc124e6
Malicious
photov_166169748705.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_887420520215.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
cb837f1c643756a6162dcbfd1dc124e6 › photov_166169748705.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$ukrzzhuhuhuhuhuhuhuhuhuhuhu
cb837f1c643756a6162dcbfd1dc124e6 › photov_166169748705.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙