Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 d2a144ade8aef362578a72f001188d25
Sha1 b5511327e550ada6adc95283cd2ea1e4cff62469
Sha256 ee9a2bebfb8f251e1783ae8b475be83004788e5bc5d26e2ff87087dbdd43781a
Sha384 f1ec89a0ea670063d7933fb71a488ec0c0aa8069d92190d0f4fd078a9132d205841b2399a81b3cf12c84adc827bb3401
Sha512 c0d2b70684c4d4418c827c872c8e5fd01bea6022e2127f79e0124eb4a4772d91d119451ef09a11f7924746c3b9a0fca593d413146ea2558ff5fa4bf13cdda27e
SSDeep 24:9IS95tAZgV1ReHfbw1Xlxj7VrmVa3tESw22+us:95rtHV1E/bkVx1rc8XL
TLSH F1217766C22FC954D532D3313E657B4C4D1F0AED0F09322B8E3CB1BF3514458539A045
d2a144ade8aef362578a72f001188d25
Malicious
photov_648450167110.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_465884685786.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$efk7ahuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
d2a144ade8aef362578a72f001188d25
Malicious
photov_648450167110.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_465884685786.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
d2a144ade8aef362578a72f001188d25 › photov_648450167110.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$efk7ahuhuhuhuhuhuhuhuhuhuhu
d2a144ade8aef362578a72f001188d25 › photov_648450167110.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙