Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 f9e66cbac6d92fdde8ec049d5d071c13
Sha1 a1f394e89b6afa1368d8eaefb2ccf4dfb650ceed
Sha256 9d1896f0bc33084b3e00eefd38e46b36981daf8ea291f8ad193adbc034ae23ec
Sha384 08a80bd2ed84b71344fd3c6b88747477002d5d3ec798cce182398c8cff91dc9813912e3977b4d018cb22f813c19c5642
Sha512 52ae9fb34487e14dd1ee78da42900b5d0c61e09a61458b76fe2f9ee330c3ed20806d2fe9b70143a83d43f26d36b5d4950de1b01699926087d9ade7c72c8f5d0b
SSDeep 24:9fKvSwQpjewPZmOCnKBDHLduCpLy3GZMhaCshlmSGm6ibdWq8RKzfQBlm7gKkX9R:9fsSh5BmuDhNpLWGaYbP/7WOfgigB9dn
TLSH DE21B4ED805C8A14C523D6BF3C164F6D64284281EFC554D00764D92B8CF3DAC2BE46E2
f9e66cbac6d92fdde8ec049d5d071c13
Malicious
photov_225332944300.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_478277673183.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$zvf6 huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
f9e66cbac6d92fdde8ec049d5d071c13
Malicious
photov_225332944300.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_478277673183.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
f9e66cbac6d92fdde8ec049d5d071c13 › photov_225332944300.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$zvf6 huhuhuhuhuhuhuhuhuhuhu
f9e66cbac6d92fdde8ec049d5d071c13 › photov_225332944300.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙