Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 d6f42f087fba8b0c34e0783d96f3b3da
Sha1 943399882c37948a204d8fc311e6465b9dd958a8
Sha256 2d288085e1516383b5c2948e36d294163cccdf6390a9009252b22f8bfa8d6fec
Sha384 c9b0d15475fad8408a48f256dacc3c88e8cbfb5804b03402054bcfcfd60aeebed5f4f777df0aed2fad48dc5d39534be2
Sha512 1db60787dda4c781f63efea3e919a8f29aaba67c38817ba72a076aea27264df0aae7e55103db0c0d699bc976df648d17712cd3dc70a19e3c3abff5ae934fc1f6
SSDeep 24:9YCbnVpVFDQRganQy2VX6yJVMefr/mSiYhGY7NWvVvml:9ZbnVFQrnP8blr/PikGY7NW9el
TLSH EF21E950C09CE800C80AD0B9EC347A1403E8FD4529A365FF3F8AE2E1ACD8FBD9315188
d6f42f087fba8b0c34e0783d96f3b3da
Malicious
photov_405332078002.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_283504934982.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$c3_erhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
d6f42f087fba8b0c34e0783d96f3b3da
Malicious
photov_405332078002.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_283504934982.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
d6f42f087fba8b0c34e0783d96f3b3da › photov_405332078002.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$c3_erhuhuhuhuhuhuhuhuhuhuhu
d6f42f087fba8b0c34e0783d96f3b3da › photov_405332078002.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙