Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 e8043f166007f26a6c5f52a3605e516d
Sha1 d6ddadc02ebfe73988e563021fc1ed94ef8b54b2
Sha256 5a0536b8cf76a82c482ab19d58c5fb9cd0a17d1be44de8d03066b9a12575bfba
Sha384 185c50534a1d89a6a4a00d9ce76d92160bdab108724ab1bec5aa3b0087bccb564b7679e2db6af3aa11fa37cc832f7231
Sha512 acbe52ede295bf658f13a4781b419d4f32eb39d8784c89cd1bed4f0399dc966a7a4672c719c0c55241e5b474a988c1af069d13555ff057747727a7ee96f03f2f
SSDeep 24:970sTRuojCjCWGdVgbJWBwXohmlmhdTEIPnGamkTF+UaNuUammYOqPRRrHgY0kJ2:9wERrCnXblmEIfGaTTF+UkObKPRRric2
TLSH 8C21A8619185D312E2D99C31BB857E1A23670B365DC84403369F71CD38EE4C3DA4DC61
e8043f166007f26a6c5f52a3605e516d
Malicious
photov_809544229401.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_797850359859.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$lc898huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
e8043f166007f26a6c5f52a3605e516d
Malicious
photov_809544229401.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_797850359859.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
e8043f166007f26a6c5f52a3605e516d › photov_809544229401.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$lc898huhuhuhuhuhuhuhuhuhuhu
e8043f166007f26a6c5f52a3605e516d › photov_809544229401.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙