Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 fb8751301e46f56481aa68976cb0773a
Sha1 55d6ff88945b58510d7772cf66f358e541548c48
Sha256 4a14bb16ca3fff54a62affe01069772b1abde8722308ee9d07c0df6e85a43c6e
Sha384 8a0be3bfac7a4531587866aa7dc7866a87809f7f0654b7c79547b00a321893eadd0470142268c170a710b7563e565743
Sha512 e82465e05697b36a86edb13a2b050028655014c033ee2cfd63015f810871da86dc77c23bceb56d57ad4b40990e7cab37195e42e6105faae8c44cf8af4c743289
SSDeep 24:9cdDvwMgzHE7AQDsLssy1KwPnKjsOiAH+mS1bdWq4ODciDX:9cB1grE7A4s5y1Kw/KjsOjePjWVOgu
TLSH 6521E7DADB848460EC0703FE2D1ABEAEB0319B3C644681166B5567AC3D97F1D3B86170
fb8751301e46f56481aa68976cb0773a
Malicious
photov_726532253506.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_039685890999.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$s9pdfhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
fb8751301e46f56481aa68976cb0773a
Malicious
photov_726532253506.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_039685890999.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
fb8751301e46f56481aa68976cb0773a › photov_726532253506.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$s9pdfhuhuhuhuhuhuhuhuhuhuhu
fb8751301e46f56481aa68976cb0773a › photov_726532253506.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙