Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 d78075e09084fba9e077449c3bbdfec9
Sha1 8b95ed1784e5536ef14427559e57969f4feb3191
Sha256 e740c60bbbf854aba549893fecc7b8269a12d2df7a647f28910cd42ef12b795b
Sha384 dd61aa7c05986fa7daec95d2f160a3abecf1da41ce53c1186a985c7cb6d779c35119c1552574210164f6cfd9562b5c0d
Sha512 00755fab78658c57849b9f48c192eeff95a28508d5c083150009634295537058fb618d44def9ead2248c5979fc970665e904d7912f3d21d2cd19aee74264227f
SSDeep 24:9rQ2Y5Qw4UR6Kk+Ux5b5msmS1plLuSvqY+ApCOUU56IqVTQ21o4:9iHMPBPJHvCAMOUUbqv
TLSH B321AAE3C9219135E85B423165AB725CD37935D12B2317AD36B478573C4BA9A5706100
d78075e09084fba9e077449c3bbdfec9
Malicious
photov_785543720778.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_055111785262.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$g668ahuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
d78075e09084fba9e077449c3bbdfec9
Malicious
photov_785543720778.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_055111785262.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
d78075e09084fba9e077449c3bbdfec9 › photov_785543720778.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$g668ahuhuhuhuhuhuhuhuhuhuhu
d78075e09084fba9e077449c3bbdfec9 › photov_785543720778.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙