Malicious
PowerShell
MD5: 161331a02fcff9c96d7a990d7be2ddc1
Size: 63.69 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 62.2 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 10 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 08869a81a1cf7650d11680138fa7b50752982d93768a65ffb1708c53bf668ad1
- MD5
- 161331a02fcff9c96d7a990d7be2ddc1
- Verdict
- Malicious
- File type
- PowerShell · 62.2 KB
Cite this report: https://app.malva.re/sha256/08869a81a1cf7650d11680138fa7b50752982d93768a65ffb1708c53bf668ad1
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
63.69 KB · 63,687 B
First seen
2026-10-29 07:15 · an hour ago
Last seen
2026-10-29 07:15 · an hour ago
Last analysis
2026-10-29 08:01 · an hour ago
Hashes
MD5
161331a02fcff9c96d7a990d7be2ddc1
Sha1
61b449fc6321caf554cafe374797316015838536
Sha256
08869a81a1cf7650d11680138fa7b50752982d93768a65ffb1708c53bf668ad1
Sha384
844743788145e80132a8a597f99df5412e6c6a4aaefaa4f06643e7b4503b12b00286a795a9e3cc74df099e377c3cacbf
Sha512
ec4957f4ecaab6032d71f6c91f75d38396ab964ddc15597c19418cc30eb55553d5434c8310bfef13c1a8cf276ec6d91a1e957bf54d211de177eb2cbc8139cf86
SSDeep
1536:V8xJBb4Y/0sQAZncxMD71SA3zomvHn3RwR:VWJIsQPOVp3zxvHn3U
TLSH
B953F81098D136BF092B33BBED280524C0F9892E01F65BFCE5A9171E1352B18D77ED69
Detection
Symbol obfuscation
Low
8 malicious · 8 files
PS1161331a02fcff9c96d7a990d7be2ddc1T1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
VBS161331a02fcff9c96d7a990d7be2ddc1.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:ps1>scr:vbs>scr:ps1
malicious
3 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential