Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 fca03aa5def8ca77bc6bb9e5cf4be2f9
Sha1 2ce8cdec9e71f84fedbcefad63747fb4f79ee358
Sha256 2d780f19a28cde84e1c0cb2a98a45433b77ff1e79a9610b56e64ecf334d9ce8d
Sha384 3255c84f37777b982df3488727298701d987c47283ab675cb0426b337e22f4de3f5d6fe37c77701419f6b9d0da018828
Sha512 be40115e0467f3f2a4c41c89a8ac2a7478f07ab7baa66604ed9a0e8ac72e95fbe31bbc256ce782b13ba8e9c622cee79e724aa96dbf55bc4037a2a885a34af895
SSDeep 24:9eSxGRZMJo7qxJJ2CmdC5QsRF1UNSBDoqVx9gBmSTjv/RWy4tm4LXDh+X89ec:9XxSZgoqbmklF1UQ9xQPMFdPhJf
TLSH EF21A7E69D2C8DC1C0F280F72AAC5D4541325A06D11508EAC2207273BDAA9A9738B1BD
fca03aa5def8ca77bc6bb9e5cf4be2f9
Malicious
photov_242876135956.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_960460628605.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$h020 huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
fca03aa5def8ca77bc6bb9e5cf4be2f9
Malicious
photov_242876135956.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_960460628605.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
fca03aa5def8ca77bc6bb9e5cf4be2f9 › photov_242876135956.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$h020 huhuhuhuhuhuhuhuhuhuhu
fca03aa5def8ca77bc6bb9e5cf4be2f9 › photov_242876135956.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙