Malicious
Malicious

2bf2535530a84234eeb1452f9f1d90e7

PowerShell
MD5: 2bf2535530a84234eeb1452f9f1d90e7
Size: 98.25 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan

This sample is a 95.9 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files and a malware configuration (URLs in PowerShell). It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001, T1059.005 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
73d75d692d2f326d6bd81092f7775b6af6aacd425f9a9993bdbbdf5c8a26d7a6
MD5
2bf2535530a84234eeb1452f9f1d90e7
Verdict
Malicious
File type
PowerShell · 95.9 KB
MITRE ATT&CK
T1027T1059.001T1059.005T1105

Cite this report: https://app.malva.re/sha256/73d75d692d2f326d6bd81092f7775b6af6aacd425f9a9993bdbbdf5c8a26d7a6

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
98.25 KB · 98,252 B
First seen
2026-10-28 07:15 · 4 days ago
Last seen
2026-10-28 07:15 · 4 days ago
Last analysis
2026-10-28 07:15 · 4 days ago
Hashes
MD5 2bf2535530a84234eeb1452f9f1d90e7 Sha1 61fd72308aaa37ae872f86e1a01ecb467ff7443a Sha256 73d75d692d2f326d6bd81092f7775b6af6aacd425f9a9993bdbbdf5c8a26d7a6 Sha384 7cca769ab552252bdeddb34ba976ec2790842d872d651c038c75b7e6b72b7c973d5709c6a9daa0c55f0aa25a860f1097 Sha512 02bc002e0887386fdaeacf48306de9e6736982c0de63ce85439a641856facedb4e9eb2d9f9f5551edebd883bf12cf546bc4de1851d7211dcbd8bfe9490f366af SSDeep 1536:MVtOQRDE+BL6VHwfMpnu+VP59tZDIx3teQ06K:MVIQRDE0LwwUNP59nDIx3s36 TLSH 64A3E512F9B41515CD2B96F9BCD80A92C9AB8127116B28A4A3DC520D9813BDCF3FDF35
Detection
Symbol obfuscation
Medium

8 malicious · 8 files
PS12bf2535530a84234eeb1452f9f1d90e7
VBS2bf2535530a84234eeb1452f9f1d90e7.deobfuscated.vbs
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:ps1~T1027~T1059.001~T1059.005~T1105>scr:vbs~T1027~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1105
Shape scr:ps1>scr:vbs>scr:ps1
malicious 3 nodes

Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

8 malicious · 8 files
PS12bf2535530a84234eeb1452f9f1d90e7
VBS2bf2535530a84234eeb1452f9f1d90e7.deobfuscated.vbs
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]

Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
2bf2535530a84234eeb1452f9f1d90e7
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
2bf2535530a84234eeb1452f9f1d90e7
URLs in VB Code - #2 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
2bf2535530a84234eeb1452f9f1d90e7
URL in PowerShell #1 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
2bf2535530a84234eeb1452f9f1d90e7 › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙