Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 ced3baf1352046e1f00d0a41a4f9d5f1
Sha1 7754160e5077faeb6766850e572c5f9858e62c13
Sha256 e7bc77c620dfe00356a4c8993bf5751fe494a3b6d1960a2e8d79de8161d508e4
Sha384 2a323d668d3c87cc910b9151eb500d9cec5eca0d88da5a5129b8da24900c5ec9152e556ea28498283eff57acefc879b5
Sha512 5853a34e8f2f4f3717307cb04c5335d54e427b70fe9d6c507ef8dbeac33a2862b72702fa765e5d976fae410243e83d2bc671469e3b5bf7a7013d6118b7a0f761
SSDeep 24:988t2W400NdcIfIXt5eamkfglNeubHmS8Dp+Jl8qHkhbvf49WzV8bGj:9bt2WW+Zt5HPz0POp+kzzeA
TLSH 7421EA3CC555E364CDCB877AF423FECB33950158B7074972065D01543C82D1A17A9CC8
ced3baf1352046e1f00d0a41a4f9d5f1
Malicious
photov_975384469934.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_814405425464.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$z16j huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
ced3baf1352046e1f00d0a41a4f9d5f1
Malicious
photov_975384469934.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_814405425464.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
ced3baf1352046e1f00d0a41a4f9d5f1 › photov_975384469934.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$z16j huhuhuhuhuhuhuhuhuhuhu
ced3baf1352046e1f00d0a41a4f9d5f1 › photov_975384469934.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙