Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 fade308fbb50fd51b26462387eb36b39
Sha1 31322e19cb24cc87a9dc27b357812ad44ba63d1c
Sha256 dc48314e9b051ed39d848004bd73f3fe42fa00c121c868134af71b96e24c651b
Sha384 f8e4ef7a3713d0a04d90ec3691609da760b1ee04f2f3f76ac877d6af78662fd93e7396949e64098e3feafd3f7ef4fe0e
Sha512 a844e1b8297960cd5b3a34b8d207b18248d1b75e83cd40ff328ccd38c02327c12aa2b1d5bc31342c27c747885babca966e0570f53f60df69b39ae95ac491658b
SSDeep 24:9RaEqD3HA4SG7yM37EH39HymSubdWqpUFNDcaE1ByHtn:9YrD3gXGeX9HyPOW4kumtn
TLSH D611B5E1115C0C70CC3BC1F518DFCFFA35B3919130424211420D1AB93D21D4A3C08EA3
fade308fbb50fd51b26462387eb36b39
Malicious
photov_532524973609.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_558129975434.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$o86ghhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
fade308fbb50fd51b26462387eb36b39
Malicious
photov_532524973609.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_558129975434.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
fade308fbb50fd51b26462387eb36b39 › photov_532524973609.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$o86ghhuhuhuhuhuhuhuhuhuhuhu
fade308fbb50fd51b26462387eb36b39 › photov_532524973609.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙