Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 d9a7d3d13bfa4edcce33bce3f8fb3e0e
Sha1 11b1bcfaa8a3c4111642041e56cabac9a37fa237
Sha256 9f3fe27ff64b5b9ea041ce76c013cf9defe365768f9ebfe6b2461c2a3764e41d
Sha384 8000ac5c0cde35d9e2a5b08483e191533dfcd185b0c20f025dbbc2445b48e9c675dee8727ddb1e956ea6dc71b644a288
Sha512 ba080b240af6e27e0e09506c15f7311b710cca8f163044fdb229f2ca65469040fc6be75e617a099a5b8604ae41861ff62f0bdf2ac2302681d4bf6cc8ec6733b3
SSDeep 24:9kVSXQft0wzLmO2K7tsIUN2zKLuSvXcmSzns6fMqWyEFxhms5YD:91At0wvmhK7yw/SvXcPjs6U3jmso
TLSH A121B694DE94DA62E0CBC23A0E82BBE520173601D70CFD6B1D5379EB0E1C1D06B18AD3
d9a7d3d13bfa4edcce33bce3f8fb3e0e
Malicious
photov_845462799159.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_347446246220.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$xuro4huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
d9a7d3d13bfa4edcce33bce3f8fb3e0e
Malicious
photov_845462799159.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_347446246220.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
d9a7d3d13bfa4edcce33bce3f8fb3e0e › photov_845462799159.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$xuro4huhuhuhuhuhuhuhuhuhuhu
d9a7d3d13bfa4edcce33bce3f8fb3e0e › photov_845462799159.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙