Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 f2220f75f8f392f1da742298b5346383
Sha1 523326c0b50f7a03a8b6c97cb08da09d87603ab3
Sha256 fab595300e58ff1e2bfcd90eedf905053449bcdc7e6f43fec43d4bd7baba7e2a
Sha384 6b2b153c1201b80cd3ba8b07b3229b72cf7bce5d49c99c06a6a9548c53f69de9bd5582ff3f79bc2f2e19803efaa9dac9
Sha512 a015eb4d0dc306f0be859a33adb0e1cfa7c7acb093f92544262a3686df385f32ee2be5fe06981b2302ed3ad3aa55487218efc31e7ac89d6e9021f8449899a947
SSDeep 24:93CcGI7znEgJ6VK59/4Zh9g1Z/lGmS1D6fMqWy/rCx9R:9ZJJJ6VIwZcHlGP1D6U30rCjR
TLSH 0D11A518B0D9C758DA13913838AD18981333D2A352C4959357FA1466ADCE78BCF281F0
f2220f75f8f392f1da742298b5346383
Malicious
photov_995745937465.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_177376317590.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$m8cw6huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
f2220f75f8f392f1da742298b5346383
Malicious
photov_995745937465.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_177376317590.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
f2220f75f8f392f1da742298b5346383 › photov_995745937465.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$m8cw6huhuhuhuhuhuhuhuhuhuhu
f2220f75f8f392f1da742298b5346383 › photov_995745937465.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙