Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 d49d5fd9e3084092fad7e22737a8d1b0
Sha1 19404008ccb0ed2bc1306e00303bf2eb30da8257
Sha256 088ed43c2dab2f3d9e6400737dbd5edd5761e6c701abde4b5d9222500ec68338
Sha384 55158f1e273a8f8e5daac3194929a60ae4e5e67eba639b7a04825c481246dc4c7c3549984c1ea42fe764c0e4e8ea64e3
Sha512 b6eef250f6ecd3a71c83d953851041dd93b718b5678023632808a2debcccbec7b3022981b935faf225a6e9cf1436533593ca4e4d3150fc8d3ccc0f31496a1392
SSDeep 24:9jK2rJ+Og3F782qo9sbH37Zdv0Pas61YmkPgSbW3sW8xVm8QDS3G:9vrJhuA2qOsbXvvO6eT01uVXE
TLSH C031B9D3F109A41AF75491BC1C4826C2D32F6353ED6B8E21E3BD3683269BAA0D353538
d49d5fd9e3084092fad7e22737a8d1b0
Malicious
photov_669632825413.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_965558349164.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$nvy5fhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
d49d5fd9e3084092fad7e22737a8d1b0
Malicious
photov_669632825413.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_965558349164.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
d49d5fd9e3084092fad7e22737a8d1b0 › photov_669632825413.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$nvy5fhuhuhuhuhuhuhuhuhuhuhu
d49d5fd9e3084092fad7e22737a8d1b0 › photov_669632825413.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙