Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 e664dcf34bb4655a4fc0d96185c94a87
Sha1 957e288d90e9bd75cf6210324984eadcbe17091d
Sha256 003606a7621a32a6f9fcbb5df341b77c638cdf8a1b4e4ecc3cc98e96edc7fa20
Sha384 b16afd10406524b17fa89eef0dff088689383e4a61da0e200c2d1427c5987adfa77d4648839d272b80449181f169fb0f
Sha512 570ee172b0bf47bb91d53caec15695d248e55fb2cb1535bc27eb4bd619907a61806c7da5f0d92f3c8bb353ec182828b1ea0c255bab937a906ca519dc7192d8aa
SSDeep 24:9HkrIUSbnMPy8778XgDOtqo+mkrLmMhNmW8xnnPb5/r9ubOLNXP+xxzwupC0:9HkrTSzqykwgDO6T3vNDunVD9UOJP+3/
TLSH B031C619D8A17031E2C0C07F29F32369236A4F4ACD2692BA0AA64A9268F32A4E313150
e664dcf34bb4655a4fc0d96185c94a87
Malicious
photov_424204092165.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_275784418126.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$kc66jhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
e664dcf34bb4655a4fc0d96185c94a87
Malicious
photov_424204092165.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_275784418126.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
e664dcf34bb4655a4fc0d96185c94a87 › photov_424204092165.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$kc66jhuhuhuhuhuhuhuhuhuhuhu
e664dcf34bb4655a4fc0d96185c94a87 › photov_424204092165.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙