Malicious
Malicious

0a5df9accb348b6c5715e9e88e65fcfa

PowerShell
MD5: 0a5df9accb348b6c5715e9e88e65fcfa
Size: 244.01 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan

This sample is a 238.3 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 5 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
024c7dce1273e6465e5ca49a25204cf2c550185f0150cfcae37e06934fb0d60f
MD5
0a5df9accb348b6c5715e9e88e65fcfa
Verdict
Malicious
File type
PowerShell · 238.3 KB
MITRE ATT&CK
T1027T1059.001

Cite this report: https://app.malva.re/sha256/024c7dce1273e6465e5ca49a25204cf2c550185f0150cfcae37e06934fb0d60f

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
PowerShell Script
Size
244.01 KB · 244,007 B
Hashes
MD5 0a5df9accb348b6c5715e9e88e65fcfa Sha1 b7c96e60fa11e07a5b99a056bf21b2488ebc9b97 Sha256 024c7dce1273e6465e5ca49a25204cf2c550185f0150cfcae37e06934fb0d60f Sha384 33b737cdd62e23640f6dc7c4c7659e6a2d80124de0fd6499fd4cb352b6725cea3e8c8c03a0725ed9614de32e00d432af Sha512 ac2b2dabbc62c6418ebd6b67d3bc6e91064c78e39c7e74462bbe8f073ca3d5a3134a65a43d4cb38a75a5197e9af4fe207fbce8ae254c5a7afe6c755a68f79258 SSDeep 6144:LWnFbj8lHjKtfvkDBc2MKtIZ1HuWa3e59qpCW9m505o2H4:zQ TLSH B534952539C0A665124DDCB72C450C1DA9C9F477E38B6C4D7ACF49C5AF47AB88AEC838

3 malicious · 3 files
PS10a5df9accb348b6c5715e9e88e65fcfa
BIN[Deobfuscated String]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:ps1~T1027~T1059.001
Shape scr:ps1
malicious 1 nodes

Deobfuscated PowerShell UNKNWOWNmalicious
ise | huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
(?i) huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

3 malicious · 3 files
PS10a5df9accb348b6c5715e9e88e65fcfa
BIN[Deobfuscated String]
PS1[Deobfuscated PS]
No malware configuration was found at this point.

Deobfuscated PowerShell UNKNWOWNmalicious
ise | huhuhuhuhuhuhuhuhuhuhu
0a5df9accb348b6c5715e9e88e65fcfa › [Deobfuscated String]
Deobfuscated PowerShell UNKNWOWNmalicious
(?i) huhuhuhuhuhuhuhuhuhuhu
0a5df9accb348b6c5715e9e88e65fcfa › [Deobfuscated String]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙