Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 d64b7fd3d1daf6ffe87c0dd1797481b6
Sha1 e409ed68d1f31ce5189c931438cb3695c0cf4b7c
Sha256 f65d2b92dfbc4eb00248392d1e50a1a248ab9a5012b1d12ed967b9eb0e8d37f9
Sha384 d595ca86836382b5047d6d3a0e19dbebf2c8d613a45bea1598aedcb733e52170c7b31249c90c3dad1772ec5b0c9f3a58
Sha512 d70bc03b11bb032510b6d7f1ff0348115f96ba294fdcf368cea62d87d1758fe69b3d20b9836ebbb7f80d3784635ce9202d800c3fe47cba962816026463479038
SSDeep 24:9HJPNmITgEdCZWZyYic/VOmS3WEkbMHDwn18i:9HJPaEFVOPj8qi
TLSH A121965B4096CCF4DC12C93A1D3ECD1204578015C8A4F65367617AFC2D27FBA2F0696D
d64b7fd3d1daf6ffe87c0dd1797481b6
Malicious
photov_647136879985.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_358078589800.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$p562 huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
d64b7fd3d1daf6ffe87c0dd1797481b6
Malicious
photov_647136879985.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_358078589800.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
d64b7fd3d1daf6ffe87c0dd1797481b6 › photov_647136879985.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$p562 huhuhuhuhuhuhuhuhuhuhu
d64b7fd3d1daf6ffe87c0dd1797481b6 › photov_647136879985.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙