Malicious
0b9cc678832d1b989a2fe26a2623ee7b
PowerShell
MD5: 0b9cc678832d1b989a2fe26a2623ee7b
Size: 3.78 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 3.7 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted a malware configuration (URLs (emulation JS)). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.007 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- d52e50fe133cba2dccfe2ae99a45762404e365e0745215bb6ea30663382fcb8b
- MD5
- 0b9cc678832d1b989a2fe26a2623ee7b
- Verdict
- Malicious
- File type
- PowerShell · 3.7 KB
Cite this report: https://app.malva.re/sha256/d52e50fe133cba2dccfe2ae99a45762404e365e0745215bb6ea30663382fcb8b
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
JavaScript file
Size
3.78 KB · 3,783 B
First seen
2026-10-27 06:45 · an hour ago
Last seen
2026-10-27 06:45 · an hour ago
Last analysis
2026-10-27 06:45 · an hour ago
Hashes
MD5
0b9cc678832d1b989a2fe26a2623ee7b
Sha1
ff5a1d2a0af8dc9e8d214705566985f7caf699d8
Sha256
d52e50fe133cba2dccfe2ae99a45762404e365e0745215bb6ea30663382fcb8b
Sha384
7047769aa4428da6f8a6e5c0ed05fce222ac15f4e4c4b7b7e8db87e4ebc5211e73022437386fe1d7b7f365301649be4f
Sha512
d8e515022d7429ae36e6034b3d19db016c82c23dc771e76f97c8fdd389c565f6a8f22f03c26b825ae9dbc181f6897ee50daa7169fabd534340fefec822133776
SSDeep
24:2VQvPZYZDTBFLfwUvC5eBPw3gyEFVBApvnXNIb31r3XJWA68a57tiYQZx/6L1AOT:Fy1SeqKAplCdXJWAmtS1bpUljS0J
TLSH
2A71CFDD2C4AB0694A33F33DCB6B7409FB6256530609C255B48DA3846FB0524C2ADFEE
1 malicious · 1 file
PS10b9cc678832d1b989a2fe26a2623ee7bT1105 · T1059.007
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1059.007~T1105
Shape
scr:ps1
technique1 nodes
| Config. Field | Value |
|---|---|
| URL (emulation JS) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential1 malicious · 1 file
PS10b9cc678832d1b989a2fe26a2623ee7bT1105 · T1059.007
| Config. Field | Value |
|---|---|
| URL (emulation JS) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
0b9cc678832d1b989a2fe26a2623ee7b
URLs in JS Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
0b9cc678832d1b989a2fe26a2623ee7b
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account