Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 e7d98319202b5a16acdddc0124491f8e
Sha1 1a563830a31ced92d6c64cd5e95131da9f40cbb4
Sha256 f656f2c54546b145dcee04ced28605d4cbef557c4bb1d9ea7d77fa2925062dff
Sha384 751c295081f3f53417ed461d51e250ec3f508bc473f1a27a10e2adbc22a831e8e5a32e1efa19d8c85371e6c16b2960f9
Sha512 8f2febf92180deb5797294c93c71766dd969a65e1c7b17b328449f625c5a9097598017dc7c0606ed73737e64b143391aa6bd3c04d86b0809dbef6dcba765cdf4
SSDeep 24:9puJ4yasCofIfh0VnBoMwBbSbJRJv5mSbMbMHk2Iy:9w+QI0BoMxbDJv5Pbky
TLSH 40219DD78019CD15CE96EA765C2D5F610171161FCD90D10B0FA1767519A2ED137147E3
e7d98319202b5a16acdddc0124491f8e
Malicious
photov_955838701572.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_395234406875.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$z6a1jhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
e7d98319202b5a16acdddc0124491f8e
Malicious
photov_955838701572.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_395234406875.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
e7d98319202b5a16acdddc0124491f8e › photov_955838701572.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$z6a1jhuhuhuhuhuhuhuhuhuhuhu
e7d98319202b5a16acdddc0124491f8e › photov_955838701572.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙