Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 d3fbb58402a5a046e841c5af24ebbac0
Sha1 9bbf240fe7c4d2eadec961c88dc80adb07833852
Sha256 ad3b4d82935b02a5ebbff7112e3edc7ec48ce94bd7300de1128dbece71715df9
Sha384 acc02bd819cd2cce9572b49d9dda5eb092ed0f56db3508939651469fe8005f8946bfdfd5e6dc365fdb329bf63ba1c69f
Sha512 a4b968757fc690001635a3f230e154f83151755c5240e8c5011f08b2ecd156f917d6ff8b5de1efece7f0a7b3ddd4f57d30480e20b223fcaeb61801a61da89e26
SSDeep 24:9z/nMFcJWpV0D0OlMfDd6ymSJZ+oWqVqDi18:9zGcf0OqVPj+oWPN
TLSH A62133E081D24141C84F9ABBBF3BF609B10709E4A61226664BD19A4C5ECB84A96B81D2
d3fbb58402a5a046e841c5af24ebbac0
Malicious
photov_241762981719.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_665777415839.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$owu1dhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
d3fbb58402a5a046e841c5af24ebbac0
Malicious
photov_241762981719.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_665777415839.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
d3fbb58402a5a046e841c5af24ebbac0 › photov_241762981719.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$owu1dhuhuhuhuhuhuhuhuhuhuhu
d3fbb58402a5a046e841c5af24ebbac0 › photov_241762981719.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙