Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 de87cf298f58bc3f64681cb4760646c3
Sha1 71becc1cb3714cd097bf5506cd87d156aed88f44
Sha256 f020bbc4be53e62489acd8ba715ef66a3f018a34c05de1709e715e4fe2849e1a
Sha384 2e6f9d1352cb1b663866841b3f6671ca2d5f98aa3008ee93ce32bc42a0e0fac07266bcdf191b2fd133a68600758a0c76
Sha512 a86a6b7125e7c70856580b35f0d6d6867adb622e9c1b6f007f96e640bc6bb1015f29dba088b6c3efafceebe65ee6ef98e9b6bb929344d8a1d32ee730329b443c
SSDeep 24:9mjNMhz9BqUi4bqtrrDG3lit2QO+oZmL4mhHMbJjXi+sGiDBjNF5ycVqO:9KcXYvDG1io+0xJjy8ifF5ym
TLSH 9D218751D89EC641DE8B4F32D48456546964D4BF60055EE52E055CC93A3CD2B3B372D1
de87cf298f58bc3f64681cb4760646c3
Malicious
photov_457696073689.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_598609814189.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$zq13jhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
de87cf298f58bc3f64681cb4760646c3
Malicious
photov_457696073689.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_598609814189.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
de87cf298f58bc3f64681cb4760646c3 › photov_457696073689.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$zq13jhuhuhuhuhuhuhuhuhuhuhu
de87cf298f58bc3f64681cb4760646c3 › photov_457696073689.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙