Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 e0df1fb02fb903610fafc99c821a7ddf
Sha1 464e3d25acf9b67ade06605601a6578da9d8c250
Sha256 2cdf415fe135fb4aaf7bb9c4f82eb6bced787580191f7b59d78b651e471da956
Sha384 f16e676cc690a615989baee3cf8e936a381538ff64e286b0ded480a8d1f28f219ff4a827773238127760ddfc98e53356
Sha512 577e69e74ef57332457706e2010b056128bd7b85338ced405d9d5a2c6daeac6980a19a49a4014a674169563ccacc626f83a4ae185c0e38941506a1fa318e675a
SSDeep 24:9GPpu+Wx91BTYEdsb2s4cfjSqyJqD3aJbZ0W2XDmSr8+gWqzErB3IXhI:9GPhWxnBTYR2Ruza4W2TPr8+gWC04Xa
TLSH 4921C8D08968C26AF51BC4B2064E753CAF4230B0AD7D0923925E985957CBCB956554E8
e0df1fb02fb903610fafc99c821a7ddf
Malicious
photov_504755941459.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_969144611838.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$dnyllhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
e0df1fb02fb903610fafc99c821a7ddf
Malicious
photov_504755941459.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_969144611838.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
e0df1fb02fb903610fafc99c821a7ddf › photov_504755941459.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$dnyllhuhuhuhuhuhuhuhuhuhuhu
e0df1fb02fb903610fafc99c821a7ddf › photov_504755941459.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙