Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 e8c52cc99374babb0c5fbd5a95d1ff44
Sha1 f37281c91b31c60fef09fc640f617cb9f07fdea5
Sha256 b563dc1c123768b03d026db3ae03be9d8068974b21eb73b983d5a9b5c8cc438e
Sha384 f01df607a92d2eb51028c343db4c2b4c95382f0990e4844269b22b7db5c16b1f2c2c620f728ad14e8cc499948922208e
Sha512 9547daae5e233a1551861b6b85f7551f55698d9f084b45413d4c44b10c322f7ad933b620873ee17d4a8166b1d373778d74834b9db467b6de552a43bbdf70de22
SSDeep 24:9nofxmEcriXWxN7+Vl81EI7fpnDTAzWJmSPUHIcpw5wy6o9ydWiq:9OVcRxN6Vl81EIDZnPUpw5wyEq
TLSH 9D218647C4C4CCD6E847CF36A6300E815D5443B1AD2D55E7A94578E33F29ED83214235
e8c52cc99374babb0c5fbd5a95d1ff44
Malicious
photov_605077881890.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_943470214431.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$i_6dghuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
e8c52cc99374babb0c5fbd5a95d1ff44
Malicious
photov_605077881890.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_943470214431.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
e8c52cc99374babb0c5fbd5a95d1ff44 › photov_605077881890.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$i_6dghuhuhuhuhuhuhuhuhuhuhu
e8c52cc99374babb0c5fbd5a95d1ff44 › photov_605077881890.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙