Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 f757d5b909fc217bdfc3a1e973ef2f5c
Sha1 e395231ccea43fca0faa1264377cd30acb6a8f54
Sha256 5b8477011d8cb25b61fe4b75cf04aae6b960c8b0bca18678a755a729f4288d41
Sha384 fb4b1fe990dd72f81fe983004bf09dffd8cc67a779b5a7104f4c4789b442b4d659ddef03f62fa7a9cc957569719d3071
Sha512 ab698bf95a7dc1390f968a57f67681815c0d418f8374b77cbe1acdc65e870f8e7ac19319ef8c46e8144c497f879a4a842900780d02a31b0b6e991f2a94704a72
SSDeep 24:9g75//fTvtvCVbBLJh6hdNAZtmb3mR7mSDu7Bv/DYJJxj7F1TdcqFmcccpYoRO//:9gtbvtqf/istkmR7PKNKjcD8bRu
TLSH 5C21A37E49609818D9905AB268B67FE8366AC61C66857EC2020A7ACEBC8045A3757202
f757d5b909fc217bdfc3a1e973ef2f5c
Malicious
photov_866793662571.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_878575462454.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$gywt huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
f757d5b909fc217bdfc3a1e973ef2f5c
Malicious
photov_866793662571.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_878575462454.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
f757d5b909fc217bdfc3a1e973ef2f5c › photov_866793662571.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$gywt huhuhuhuhuhuhuhuhuhuhu
f757d5b909fc217bdfc3a1e973ef2f5c › photov_866793662571.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙