Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 d69d881dc5329c3f9c165ca9945b5542
Sha1 c13b86d6f8eeff80edec7968d9de5d76372fb738
Sha256 e963b8b1f2b916edfcc0eee4fe6a9e026a9578ea89395733fe0ac3f2ff0f5c9f
Sha384 ba7028a0fff91778ae161bfdcc5ca14b63173304042fb6c8f3bff2fe2d6d96f782a8b4227f581537d110ad86c78a6271
Sha512 71525c534f9d85203730f8f4438c47e116067bd46f741cc56085928119cdae8a8a237b6f2276047f2de589ea9c192c5604bc32a985088ff71432c8bbad9d5bc5
SSDeep 24:9xOaid6SVw4H7YyZ+j3Dd2ZmS+bWHUbzYsX:9Iaid6SVt7Ya+bDdSPmd
TLSH B511A52440EDC5D2F85292F22817769DE331FD81108370E3E35F3A7039BE89A53440A2
d69d881dc5329c3f9c165ca9945b5542
Malicious
photov_390990734403.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_936469134080.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$ar6lfhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
d69d881dc5329c3f9c165ca9945b5542
Malicious
photov_390990734403.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_936469134080.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
d69d881dc5329c3f9c165ca9945b5542 › photov_390990734403.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$ar6lfhuhuhuhuhuhuhuhuhuhuhu
d69d881dc5329c3f9c165ca9945b5542 › photov_390990734403.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙