Malicious
Malicious

594d680beb220ebdac604db96e0eb55f

PowerShell
MD5: 594d680beb220ebdac604db96e0eb55f
Size: 224.87 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan

This sample is a 219.6 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 5 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
fb79b3cf3fe1752b147354c574106f6c89ed6cfeeec3b1919a0f30ccbcb856df
MD5
594d680beb220ebdac604db96e0eb55f
Verdict
Malicious
File type
PowerShell · 219.6 KB
MITRE ATT&CK
T1027T1059.001

Cite this report: https://app.malva.re/sha256/fb79b3cf3fe1752b147354c574106f6c89ed6cfeeec3b1919a0f30ccbcb856df

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
PowerShell Script
Size
224.87 KB · 224,868 B
First seen
2026-10-31 07:45 · an hour ago
Last seen
2026-10-31 07:45 · an hour ago
Last analysis
2026-10-31 07:45 · an hour ago
Hashes
MD5 594d680beb220ebdac604db96e0eb55f Sha1 a2bdfb5de3643c7b865a7688c2c445e833c65ffc Sha256 fb79b3cf3fe1752b147354c574106f6c89ed6cfeeec3b1919a0f30ccbcb856df Sha384 dc1bb969908d6d03651ebf341944a210553e18267a1be82c58e5faf819cd956f3f3a58354fc9423f6d551b0540c7e644 Sha512 ef1d1c22491c29b976ec900f2b72a2a1257261e925d355cfe209559936fbe9495e63ed4ac758a74289a0a737b521863812b85b13ff4fc8b250bf62c4f32b2f1a SSDeep 6144:242Se48TGOKy0fPpLvainC+nm40K6H2izdm5xaZzfJ:iTIJmiM TLSH 1E24832439C0A665168DDCB72C414C1DAAC8F537E387AC5D79CE49C5AF47AB887EC838

3 malicious · 3 files
PS1594d680beb220ebdac604db96e0eb55f
BIN[Deobfuscated String]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:ps1~T1027~T1059.001
Shape scr:ps1
malicious 1 nodes

Deobfuscated PowerShell UNKNWOWNmalicious
ise | huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
(?i) huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

3 malicious · 3 files
PS1594d680beb220ebdac604db96e0eb55f
BIN[Deobfuscated String]
PS1[Deobfuscated PS]
No malware configuration was found at this point.

Deobfuscated PowerShell UNKNWOWNmalicious
ise | huhuhuhuhuhuhuhuhuhuhu
594d680beb220ebdac604db96e0eb55f › [Deobfuscated String]
Deobfuscated PowerShell UNKNWOWNmalicious
(?i) huhuhuhuhuhuhuhuhuhuhu
594d680beb220ebdac604db96e0eb55f › [Deobfuscated String]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙