Malicious
PowerShell
MD5: 594d680beb220ebdac604db96e0eb55f
Size: 224.87 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 219.6 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 5 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- fb79b3cf3fe1752b147354c574106f6c89ed6cfeeec3b1919a0f30ccbcb856df
- MD5
- 594d680beb220ebdac604db96e0eb55f
- Verdict
- Malicious
- File type
- PowerShell · 219.6 KB
Cite this report: https://app.malva.re/sha256/fb79b3cf3fe1752b147354c574106f6c89ed6cfeeec3b1919a0f30ccbcb856df
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
224.87 KB · 224,868 B
First seen
2026-10-31 07:45 · an hour ago
Last seen
2026-10-31 07:45 · an hour ago
Last analysis
2026-10-31 07:45 · an hour ago
Hashes
MD5
594d680beb220ebdac604db96e0eb55f
Sha1
a2bdfb5de3643c7b865a7688c2c445e833c65ffc
Sha256
fb79b3cf3fe1752b147354c574106f6c89ed6cfeeec3b1919a0f30ccbcb856df
Sha384
dc1bb969908d6d03651ebf341944a210553e18267a1be82c58e5faf819cd956f3f3a58354fc9423f6d551b0540c7e644
Sha512
ef1d1c22491c29b976ec900f2b72a2a1257261e925d355cfe209559936fbe9495e63ed4ac758a74289a0a737b521863812b85b13ff4fc8b250bf62c4f32b2f1a
SSDeep
6144:242Se48TGOKy0fPpLvainC+nm40K6H2izdm5xaZzfJ:iTIJmiM
TLSH
1E24832439C0A665168DDCB72C414C1DAAC8F537E387AC5D79CE49C5AF47AB887EC838
3 malicious · 3 files
PS1594d680beb220ebdac604db96e0eb55fT1027 · T1059.001
BIN[Deobfuscated String]T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001
Shape
scr:ps1
malicious
1 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
ise | huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
(?i)
huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential