Malicious
Malicious

035ded5eae9a7a23cda233d5d0044b46

PowerShell
MD5: 035ded5eae9a7a23cda233d5d0044b46
Size: 98.25 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan

This sample is a 95.9 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files and a malware configuration (URLs in PowerShell). It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001, T1059.005 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
86dcaa0c708c39c9f9e45cc529c8c3ab43e3d3f160536a8394991b19fa2f2d38
MD5
035ded5eae9a7a23cda233d5d0044b46
Verdict
Malicious
File type
PowerShell · 95.9 KB
MITRE ATT&CK
T1027T1059.001T1059.005T1105

Cite this report: https://app.malva.re/sha256/86dcaa0c708c39c9f9e45cc529c8c3ab43e3d3f160536a8394991b19fa2f2d38

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
PowerShell Script
Size
98.25 KB · 98,252 B
First seen
2026-10-28 11:00 · 18 minutes ago
Last seen
2026-10-28 11:00 · 18 minutes ago
Last analysis
2026-10-28 11:01 · 17 minutes ago
Hashes
MD5 035ded5eae9a7a23cda233d5d0044b46 Sha1 fc28b80a030798911b690ac28311b6e61538599a Sha256 86dcaa0c708c39c9f9e45cc529c8c3ab43e3d3f160536a8394991b19fa2f2d38 Sha384 6540294fa6105c3cde7ff812013aafa9716d96cafca1838c20963db74a3445318e6a5c25bdc9c474fa14bc2e48630afe Sha512 0da1e7e898b716fb6b143dbf787f0b95e3b286d7ed8ed1e32bd39c4b71f0c6b4cc4cdb4619729b2879ddc80edcfdd6e055a803d0328399f55a3ef27a6604e9b0 SSDeep 1536:OEToRvUBQpEiiEhdUrH/cpGqAxBfMvSmvhEeYN:OuoRvUKpEdEs2GqYBMvSmv+rN TLSH 86A3E862F9B40505CD1B96F9FCD41961C9AB8127151B28A0BFCC5309A817EECB3FDB26
Detection
Symbol obfuscation
Medium

8 malicious · 8 files
PS1035ded5eae9a7a23cda233d5d0044b46
VBS035ded5eae9a7a23cda233d5d0044b46.deobfuscated.vbs
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:ps1~T1027~T1059.001~T1059.005~T1105>scr:vbs~T1027~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1105
Shape scr:ps1>scr:vbs>scr:ps1
malicious 3 nodes

Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

8 malicious · 8 files
PS1035ded5eae9a7a23cda233d5d0044b46
VBS035ded5eae9a7a23cda233d5d0044b46.deobfuscated.vbs
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]

Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
035ded5eae9a7a23cda233d5d0044b46
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
035ded5eae9a7a23cda233d5d0044b46
URLs in VB Code - #2 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
035ded5eae9a7a23cda233d5d0044b46
URL in PowerShell #1 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
035ded5eae9a7a23cda233d5d0044b46 › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙