Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 fa5a7340066783b91f2f111adef5ff18
Sha1 732dfbefbf39265406a9062fc32d3cfe761ec135
Sha256 bd100490e2ca65ffc88be0938873f3f8fef7b46d1858c4373411c879acf726c0
Sha384 8164c1f839e8994271dc9264e1e828543e36ad937f6bd70a217642a2861cafbdf3714a5cf674c953ae69b4fb1fb2db13
Sha512 abdb6467360a1dd2c0920971f997fee624128f318ee4a91b480a17797a99a51ad153d8798f577f22bda1f517fa948d201de69fd18b92a3ecb3f91e377c9df87d
SSDeep 24:94H5NcUqYD68tL5vOp8ZSITsIvzmSU+oWqG0shAzGFwTm:94H3Iv855Wpp+BzPU+oW/SoWm
TLSH 952184EDE20AD0CED543C374A606899E782806D53B063BA36B15A941BA58DCE210FBD1
fa5a7340066783b91f2f111adef5ff18
Malicious
photov_228459378333.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_780607072411.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$smxf huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
fa5a7340066783b91f2f111adef5ff18
Malicious
photov_228459378333.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_780607072411.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
fa5a7340066783b91f2f111adef5ff18 › photov_228459378333.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$smxf huhuhuhuhuhuhuhuhuhuhu
fa5a7340066783b91f2f111adef5ff18 › photov_228459378333.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙