Malicious
Malicious

09d4dd3d504f9cd401b24fef09314974

PowerShell
MD5: 09d4dd3d504f9cd401b24fef09314974
Size: 2.77 MB
application/x-powershell
Ctrl + scroll to zoom · drag to pan

This sample is a 2.6 MB PowerShell classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files. It matches 6 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
2a6ebbac8400cd351b992216a02eea3927be2d5debdbb12f14cefd976475536f
MD5
09d4dd3d504f9cd401b24fef09314974
Verdict
Malicious
File type
PowerShell · 2.6 MB
MITRE ATT&CK
T1027T1059.001T1059.007

Cite this report: https://app.malva.re/sha256/2a6ebbac8400cd351b992216a02eea3927be2d5debdbb12f14cefd976475536f

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
PowerShell Script
Size
2.77 MB · 2,769,073 B
Hashes
MD5 09d4dd3d504f9cd401b24fef09314974 Sha1 3777cc5157e30ea0d8bcddf701c77e1eedb1908e Sha256 2a6ebbac8400cd351b992216a02eea3927be2d5debdbb12f14cefd976475536f Sha384 a3a444b9e65817eafaaec6ec8f29d55a6c40aac3153fe8b611669c724feaa083bfad4e95e9d6e514022ce9907e35d7cb Sha512 41f41c7804ec871af96521b12e095d8c6b864e88128f68c19a72271cde17a3db2bf1dd5c95cd6ecc324b85e6ffcfab6c2edfc369f44c2537b160b4e4263a0676 SSDeep 24576:+q72pMg9pGwY6Pw+K7iHIb1tdcmvNa8UBBE/xLrLCpLtWMgMawO4d5a0Cl39WJaT:z9ip/ixdFGC/M93Jafx0lj7DJSGPs TLSH 63D502066F060E0F8F3C82BA66530863ADB2B945C098D3E63EDB5D7EE606E55313D19D

3 malicious · 3 files
PS109d4dd3d504f9cd401b24fef09314974
PS1[PowerShell Command]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:ps1~T1027~T1059.001~T1059.007
Shape scr:ps1
malicious 1 nodes

Trace d'emulation JS (ordonnee) UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

3 malicious · 3 files
PS109d4dd3d504f9cd401b24fef09314974
PS1[PowerShell Command]
PS1[Deobfuscated PS]
No malware configuration was found at this point.

Trace d'emulation JS (ordonnee) UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
09d4dd3d504f9cd401b24fef09314974
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙