Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 d88014128fb553fdd388b93668ad075a
Sha1 ede6ae7cd6c205c50a30b7f785325b6e70f886fe
Sha256 d949b642bc0185a1bf37557038f2c24e8879070b9563f1fd7862adb43a9df209
Sha384 7d732c74c905493d6f49f0960a1e027b94ecbf27b313f9c22ee11e876f523b135350fd93927c6383658addf26f6de566
Sha512 b7894b55f7ef9b979584c8ba6618cc93b275f907a182683895d9a5e0477ddbe5ea40f0b3a89e2f07e30ca81315ae41a36c43cbe24047e4624f7b5bca6dd0a65f
SSDeep 24:9IUN9/On4TiyxZ/SZ8SFA8B2M8vFmSog4NWyoyoL3bZy04N+fUG5+A:9I68JyxlSZ8kt8M89PNZL3w04NKZH
TLSH 5C21A7E0C0368205EA53473F36A85ED61EB201810491A41C479C9AB3F69B6F84B5C4D5
d88014128fb553fdd388b93668ad075a
Malicious
photov_038798911662.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_584811820317.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$v16bihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
d88014128fb553fdd388b93668ad075a
Malicious
photov_038798911662.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_584811820317.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
d88014128fb553fdd388b93668ad075a › photov_038798911662.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$v16bihuhuhuhuhuhuhuhuhuhuhu
d88014128fb553fdd388b93668ad075a › photov_038798911662.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙