Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 f492da7d9327c651986611f044ae71fd
Sha1 f7bfd90e97a1274ff809fb6c3a1bb9f83b7aed12
Sha256 c665cc1b6d1da78c1a7e2da15d9f10f9c1e8ddceedcfb70f541f6893f908f4b7
Sha384 91838a8547191caf7c5f84e9166ab765b68a038cad9f12d3e1900d1303e84cb99d4ad14f7371834c9d7938d8cda2f5cb
Sha512 4cced4bbe6aca0cb0cbdc0e5a83b042dcc4a43762f8e0758d699f93600639346f12a0076679f2f9a8f9dd3e3389c4aac4d466b36b770e1b0fc666f8d1e6bfd66
SSDeep 24:9kq6H/7u2LtasTXNgm0iDBW6dklkn0IPmStAbY2blZsWqCu6wvvl46W9sYnTwI3:9U9NxDBW6Ov0PtIYjWbu1aPKU
TLSH 4521B789D4375095C088C27369817C38621E4894465A15E1A79F3A2DFEF0B8EB157441
f492da7d9327c651986611f044ae71fd
Malicious
photov_276272927056.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_872710895838.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$xduq huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
f492da7d9327c651986611f044ae71fd
Malicious
photov_276272927056.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_872710895838.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
f492da7d9327c651986611f044ae71fd › photov_276272927056.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$xduq huhuhuhuhuhuhuhuhuhuhu
f492da7d9327c651986611f044ae71fd › photov_276272927056.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙