Malicious
3debfc343c5e9fe25d5df0a5c6879dcd
PowerShell
MD5: 3debfc343c5e9fe25d5df0a5c6879dcd
Size: 1.91 MB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 1.8 MB PowerShell classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files. It matches 6 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 6f4621920f7f43e350bb4044d4d711a1bb9de6911803705853f7734cf1484f11
- MD5
- 3debfc343c5e9fe25d5df0a5c6879dcd
- Verdict
- Malicious
- File type
- PowerShell · 1.8 MB
Cite this report: https://app.malva.re/sha256/6f4621920f7f43e350bb4044d4d711a1bb9de6911803705853f7734cf1484f11
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
1.91 MB · 1,907,961 B
Hashes
MD5
3debfc343c5e9fe25d5df0a5c6879dcd
Sha1
92b734803f38ee9cc04d7ce465ff4c105fc112ee
Sha256
6f4621920f7f43e350bb4044d4d711a1bb9de6911803705853f7734cf1484f11
Sha384
c3db318c6734ee570259a41f22d6d3209cf5eb27afbf5f94eca31552c81cc46f4d09b2a20a1bf6becdb8fa16822481af
Sha512
76ca256b80b6c2d48c3455cd9b8a586329b98229421ec65dd90c5ff044171dad4cd59e4133f184347ac8621755aa87ac682040b25c4aa8e1d4355d1712068a11
SSDeep
24576:+JhDmzf6BvtW+Cb/Z2NwvUP0shEQmNpEJ+GbLx95BBm+2DIAGuYT3AEvGRyB3Fsn:whyT+ybwIlc92zEAHCG81C
TLSH
049512075F061E0F8F3C8276A3570852AAA27946D05AD3E63EDF9D7FE605E44313D298
3 malicious · 3 files
PS13debfc343c5e9fe25d5df0a5c6879dcdT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001
Shape
scr:ps1
malicious
1 nodes
3 malicious · 3 files
PS13debfc343c5e9fe25d5df0a5c6879dcdT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account