Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 ffed0926e9becfc5e62acfbe591df5a9
Sha1 706406ad2a4cfb30ea07153d9f44fb24ebfab7fc
Sha256 885bc1d1ac3ee09f54ab5550d641da1b500eadb2bc1142392b8a7f041720196b
Sha384 8561f67632b1ed25b081844f591164944a9e02ce5bf47227b7124616dc69d3e6037288b5162b7c9467d4bbf472dabb6d
Sha512 3ff02f5513063ea26eecd6d039d868cc809ac3c8572d80a8c8528ae779f613f6d1898742ff7ac6faa3465922210d3f4082404dcf743f43f688f18d5b2321edd3
SSDeep 24:9C9YwXFN1yNn21YQ93DL3ylq70AY3H3WQmSthGY78OzT91WTg:9GanByXylcU3H3DPbGY78OV13
TLSH C121A7A4A018DD82F58AC237F844914E31CC9CA521306E97328312EDE503B9ECFA6BA0
ffed0926e9becfc5e62acfbe591df5a9
Malicious
photov_721727721173.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_201935873647.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$l5r8 huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
ffed0926e9becfc5e62acfbe591df5a9
Malicious
photov_721727721173.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_201935873647.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
ffed0926e9becfc5e62acfbe591df5a9 › photov_721727721173.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$l5r8 huhuhuhuhuhuhuhuhuhuhu
ffed0926e9becfc5e62acfbe591df5a9 › photov_721727721173.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙