Malicious
573f552a1742f9809430004b9346c943
PowerShell
MD5: 573f552a1742f9809430004b9346c943
Size: 74 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 72.3 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 8 embedded or derived files. It matches 8 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- c458e1da532c63656692cc9a884f7029fdcce5eb6c096798294137432727636d
- MD5
- 573f552a1742f9809430004b9346c943
- Verdict
- Malicious
- File type
- PowerShell · 72.3 KB
Cite this report: https://app.malva.re/sha256/c458e1da532c63656692cc9a884f7029fdcce5eb6c096798294137432727636d
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
74 KB · 74,004 B
First seen
2026-11-04 08:45 · an hour ago
Last seen
2026-11-04 08:45 · an hour ago
Last analysis
2026-11-04 08:45 · an hour ago
Hashes
MD5
573f552a1742f9809430004b9346c943
Sha1
67c898bb597a668b80c259f938291492a75a9dac
Sha256
c458e1da532c63656692cc9a884f7029fdcce5eb6c096798294137432727636d
Sha384
da8f83a73686170f7ab198795de2e313ec356c9341cb6ce112e6dc91d8aad974be44162c79b4a84851c19ce525b0428a
Sha512
1f27ef912999a55899b0fde41b0a8c5a63ad010a0cb2f5e77c2b440a2f94392321fe390fa071b059033ad7bd703c20485290043ff42415c08cbb7659f653736c
SSDeep
1536:TAczqQuyhsdJ0e63eu/YVvX3o2dGoJJo3/WyNYx028o+n+os++hh:s4He6uu/Y5no6lJJouy2xoo+n+os+Kh
TLSH
CC738E64CA5201768B43AB58BCA80A34CA7DC321857719A0F5DD8B0CA505DECF7BE5EF
4 malicious · 5 files
PS1573f552a1742f9809430004b9346c943T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001
Shape
scr:ps1
malicious
1 nodes
4 malicious · 5 files
PS1573f552a1742f9809430004b9346c943T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account