Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 e89ee7ba58d7cc283959546981a84588
Sha1 d9c78f56069ca7a59bf8df237936406af315b1a9
Sha256 54536ae68da2f6cc9c90d02b057a9e67d845d62efcc7990a85b80c65676d3d3b
Sha384 91e6ce09ada531ed7a65ced9aac2747f84ce15dea27d43951bfca6b8c77064e629414676fadf2454129571c7900ec399
Sha512 361ce0d55091e39f598ba4bdf20658146a282886408dec289b0ef7309a69be7a561ac2657f71db0582d55c025775b720c8153b979ac31fd5b46da9d47915d788
SSDeep 24:9VRSTESbaiEmF6ILOuYG4Z6vJ51ZmSe69MrS/jWsd64Pe:9WQoaiEmAi4IvJPZPZyO/jhdk
TLSH A521C684D04AADA2C51781F84AA9258E4173CA1C630BD1035EFE6F5F295857C8DF8E6E
e89ee7ba58d7cc283959546981a84588
Malicious
photov_150471622163.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_580504624180.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$hyze huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
e89ee7ba58d7cc283959546981a84588
Malicious
photov_150471622163.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_580504624180.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
e89ee7ba58d7cc283959546981a84588 › photov_150471622163.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$hyze huhuhuhuhuhuhuhuhuhuhu
e89ee7ba58d7cc283959546981a84588 › photov_150471622163.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙