Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 e4254147b8b3f661a854f9efc05c025d
Sha1 93d016619a565b967171279e61dc431500601153
Sha256 ef2e462e6a54773fde38374287ee2fdada4797f02f6ce7fb50a4f004ecb736fc
Sha384 30ce598e9f2bc6f5bc8c4cc6516af032be5ab27c9de259bd7fb0ee6151182888246b42910e6404e7aa4ac92ab0c13e2d
Sha512 664bfa59dd28b1a76dba9adfc0c7f4a5664e6d268fb0dc685da1a64cef64fec6af38dda5f6239806fd9a06013fb05078120546276c8d88b18dd3c2c97c9f11fe
SSDeep 24:9hYybDlIvrInKSiVjMGZLSxcqo4LCQveJ9ZmkZNU/5cpeYChG0XbNv3YxdQ:9hYybDl+rfTxLOoKCQ4HTf0cpeYYYI
TLSH BB31F7E4809E4183D4C3D1B0FBF3255EE52489B01435E273968C60C8FEA5D098BE0686
e4254147b8b3f661a854f9efc05c025d
Malicious
photov_922438601201.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_120532894686.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$f5ir6huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
e4254147b8b3f661a854f9efc05c025d
Malicious
photov_922438601201.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_120532894686.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
e4254147b8b3f661a854f9efc05c025d › photov_922438601201.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$f5ir6huhuhuhuhuhuhuhuhuhuhu
e4254147b8b3f661a854f9efc05c025d › photov_922438601201.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙