Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 d95814b1932addb75ef3aa377ba33e06
Sha1 eb356a11ad87eb5f5662304c780eaa74af9aa0bd
Sha256 fb0f42ff125f9759808c5261bfafd2ee8916eb1952fd73d6492484b7d30bfdf9
Sha384 f032b5e8075b31edd6919aa8857df082a5e5a7f72f4cf6554da86ae3647f2d1cbedfa5829c5ec3447f237db6372aabc5
Sha512 40eb8cf9ea125c8792c1349402a332ee010aca16cf04b65c5f2465349274d2e15e45a10e5b73d0276f7acb2d0265a4ccdefcb6ed1dfb89b8cec943dca984b102
SSDeep 24:97B/7ErX6NLHru6Bj9N+6bEs4oTBAQmS2T7hZ79qFYdHvkHhuArn:97mTca8Es4e5PIlZ7gY4uGn
TLSH E221C8E0A518FC9AD48EC7329C65295E1038B552720F541001EBA6FF510CEF8B7A9646
d95814b1932addb75ef3aa377ba33e06
Malicious
photov_613067252982.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_880989442604.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$vy03rhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
d95814b1932addb75ef3aa377ba33e06
Malicious
photov_613067252982.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_880989442604.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
d95814b1932addb75ef3aa377ba33e06 › photov_613067252982.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$vy03rhuhuhuhuhuhuhuhuhuhuhu
d95814b1932addb75ef3aa377ba33e06 › photov_613067252982.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙