Malicious
22aad9f5b4c57bb7c4a45d609646dcc6
PowerShell
MD5: 22aad9f5b4c57bb7c4a45d609646dcc6
Size: 3.28 MB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 3.1 MB PowerShell classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 4bc0014914404aa61d4adb137ef6b85dc197b3de2cd78ed6a692a648d94c39bd
- MD5
- 22aad9f5b4c57bb7c4a45d609646dcc6
- Verdict
- Malicious
- File type
- PowerShell · 3.1 MB
Cite this report: https://app.malva.re/sha256/4bc0014914404aa61d4adb137ef6b85dc197b3de2cd78ed6a692a648d94c39bd
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
3.28 MB · 3,279,076 B
Hashes
MD5
22aad9f5b4c57bb7c4a45d609646dcc6
Sha1
583c6333b4720747c3e2c24b4ea481d49bac4357
Sha256
4bc0014914404aa61d4adb137ef6b85dc197b3de2cd78ed6a692a648d94c39bd
Sha384
588e655f83a77bbadd91ae04977c50f86d1c23edb4c07c49f23bee0418c92b646d29db82bddb524df0ae00a17bf77735
Sha512
e945333c420806b7a190508459bd5886d3c9344997739ba03451c2c7ebcd0a46e682819de76ca0e735bd7910c56cac71dd96f2eb371d540d1aea3a4c734b0f94
SSDeep
49152:/+3JVXSXPht5wW1dhRdyX9k8i3Ar4KdXz:0
TLSH
EBE5C8BC59EAF76585A05E2AFDDEF5091C117FF262CA9E87788CA3F841114548FB0832
2 malicious · 3 files
PS122aad9f5b4c57bb7c4a45d609646dcc6T1027 · T1059.001
EXE[Base64-Block @0x00000011]
Structure
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001>pe:exe
Shape
scr:ps1>pe:exe
malicious
2 nodes
2 malicious · 3 files
PS122aad9f5b4c57bb7c4a45d609646dcc6T1027 · T1059.001
EXE[Base64-Block @0x00000011]
PS1[Deobfuscated PS]
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account