Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 d03af745fb915a315215a6924bed6833
Sha1 081ad50b3a4eb87ecc369fce566903f6d7cccef5
Sha256 5b97c0b4d40865bb1841ef9b72bffcb13139958dca8df63e44a120fb09e42e5b
Sha384 3c23a395f837d6cd26b5caddbf2bc9d99e7ea91d661a63793bcab5881ce9de9a5f5d55cb9cfda7f0cb125458da16a5c0
Sha512 070feae05f3a943b84cea73ee5c80f17fe3b11f5eaff16efeef76b9218b6ba6b96d9b26190a4ebfb3289b83d086e77011c6a4f9a8270171491c7dafaba517bfd
SSDeep 24:9P2IkOe5Co71NQgpzn5OrinB/452eTamYWIl54J0QZ9aJKJCpPnO21ZmaX:9P/je531vn0riB/452eTaj7lRQbawChR
TLSH 79215100C324EBA8E319A2B2D4F50D161119386C111E7E733BA77C99366E694A62D647
d03af745fb915a315215a6924bed6833
Malicious
photov_217639253336.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_367773281455.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$k37nkhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
d03af745fb915a315215a6924bed6833
Malicious
photov_217639253336.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_367773281455.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
d03af745fb915a315215a6924bed6833 › photov_217639253336.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$k37nkhuhuhuhuhuhuhuhuhuhuhu
d03af745fb915a315215a6924bed6833 › photov_217639253336.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙