Malicious
PowerShell
MD5: 1548dd567d732c40fd1c18480324d97a
Size: 218.99 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 213.9 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 5 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 7be358c6fb07ebdb94412c652f94187d03c4b8a9ce0c34d6c235758adc590c7e
- MD5
- 1548dd567d732c40fd1c18480324d97a
- Verdict
- Malicious
- File type
- PowerShell · 213.9 KB
Cite this report: https://app.malva.re/sha256/7be358c6fb07ebdb94412c652f94187d03c4b8a9ce0c34d6c235758adc590c7e
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
218.99 KB · 218,992 B
First seen
2026-11-02 06:30 · 2 hours ago
Last seen
2026-11-02 06:30 · 2 hours ago
Last analysis
2026-11-02 06:30 · 2 hours ago
Hashes
MD5
1548dd567d732c40fd1c18480324d97a
Sha1
75136ebc7735ee4e074c3c597ba4a90ab69ce471
Sha256
7be358c6fb07ebdb94412c652f94187d03c4b8a9ce0c34d6c235758adc590c7e
Sha384
9d0f7efb6ebf224cc178a0f54bdc54e64857fb4518bcfcafb57bde7584d1597733a655224eb04e0ec15d562943032ee5
Sha512
30d05f0a26484f8d721d87a5e0b95dc9f193d31b9ad06285fee135a3962cfa85477c7461b7bd5a8518640de5857a15aec058be4bab190d828e975ba23489a1de
SSDeep
3072:ASuKcjaFO69I75pCMN1W78t3XQ6E23GupskUTMtX9aLbMzKXDYVUM8joOq0:Okop9WUnQh23FUTGX9aLRTYV5cT
TLSH
5C24742439C0A665264DDCB72C410C1DAAC9F577E3876C5D79CF49C4AF47AB88AEC838
3 malicious · 3 files
PS11548dd567d732c40fd1c18480324d97aT1027 · T1059.001
BIN[Deobfuscated String]T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001
Shape
scr:ps1
malicious
1 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
ise | huhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
(?i)
huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential