Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 eae6b93765f3cde8ff402d902872253c
Sha1 285003110f6868c0d184656be34707233e18f6b9
Sha256 bda937cde056a7c3080ae1f5ee9a30b6855b7dee33eb2695e28a79cbc25e309f
Sha384 416c67c69c74b00754d344a22285ffd519bfbb37eedd9922f83784ca5b70f9eed4c8d3fd5cd58709caca94a116d10ea9
Sha512 9ef7527d3b3240a9407c6c83e9b3894188c5d170d63c5c27032c4e800deca183496647085affc1c1b0bd4c1cef1ec0c256c98f8f7ec28796d144dedbc04280e7
SSDeep 24:9ebNOsRmzG9eNW1EFSuq9dbthQmSDb+24R8etY+V+fBlVnxAvK:9eTRmzG9e81Edq99t2PDytYR/kvK
TLSH A4216378D884FA13D213D572EC6CF444F8A64AB055094CAC33273DBDFC139E96744460
eae6b93765f3cde8ff402d902872253c
Malicious
photov_777582167527.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_477090693198.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$luc12huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
eae6b93765f3cde8ff402d902872253c
Malicious
photov_777582167527.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_477090693198.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
eae6b93765f3cde8ff402d902872253c › photov_777582167527.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$luc12huhuhuhuhuhuhuhuhuhuhu
eae6b93765f3cde8ff402d902872253c › photov_777582167527.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙