Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 dd99d9f0e53c1924eca733d554e262c4
Sha1 ce31ac2c83c7cfccc6a70195f38f7f29454befac
Sha256 56934e430a2db7f8a54278a4dda96d9d9c2df8edda55281ae77eebda0436e07c
Sha384 b90952d7a6d8f2a793bba1596d8b2e83c4b9d506588bb52467ebe92a38a56ade82959d6df6ba976f4bffa133664cf927
Sha512 1c79bba6083f0b1c6cc49178d1b797b5c0ea9a3fc5c177d89577641e4c837bef05c1495a78d7aea58845fa4889c6e99c7f95fd44ba518863c1d784f3b06543a5
SSDeep 24:9MNcbH93J578K6FudN/KChEhmbD5j7C305mSa+gWqbqrxvNNFA:9MNYH9Z5oKW+RphumX5j7CE5Pa+gW59i
TLSH D121B7C48064D6C2C947E232E83F8AE5140D1BEC53968BFA435C3A1A066CC1E115C4D1
dd99d9f0e53c1924eca733d554e262c4
Malicious
photov_758641778182.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_833495075426.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$ig2blhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
dd99d9f0e53c1924eca733d554e262c4
Malicious
photov_758641778182.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_833495075426.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
dd99d9f0e53c1924eca733d554e262c4 › photov_758641778182.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$ig2blhuhuhuhuhuhuhuhuhuhuhu
dd99d9f0e53c1924eca733d554e262c4 › photov_758641778182.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙