Malicious
600d2f1f2a31008f9d1d18ca4d0b4443
PowerShell
MD5: 600d2f1f2a31008f9d1d18ca4d0b4443
Size: 1.02 MB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 998.6 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 19823c1ac3847ec7bbaa5d9d68ebed35eeb5f85f9db0292ad818df306d99009d
- MD5
- 600d2f1f2a31008f9d1d18ca4d0b4443
- Verdict
- Malicious
- File type
- PowerShell · 998.6 KB
Cite this report: https://app.malva.re/sha256/19823c1ac3847ec7bbaa5d9d68ebed35eeb5f85f9db0292ad818df306d99009d
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
1.02 MB · 1,022,552 B
First seen
2026-09-15 13:01 · one month ago
Last seen
2026-09-15 13:01 · one month ago
Last analysis
2026-09-16 04:00 · one month ago
Hashes
MD5
600d2f1f2a31008f9d1d18ca4d0b4443
Sha1
f2c9c07d60219fd83dd210f6c1080d43f6298de0
Sha256
19823c1ac3847ec7bbaa5d9d68ebed35eeb5f85f9db0292ad818df306d99009d
Sha384
276c1ec6cf8c7ec1d769fb5c189f7863b453d465d121ac3033ce9d456c1fbad545604607068307af78d5561cb2a201e2
Sha512
e21a1b07faea79b9de216e2950ac979ae9b6567b0eb532187d03510d763bf681cc6db43a4c71dd36f1bb6beff7b7dfeb7cb8f19005ca1334845092a277754f69
SSDeep
24576:DVw/cH2c0QxMo7ZzFhw++MGu9misGxmBxaMNHK0Wg:D4chNj+mmPdk4
TLSH
01251231EA5529BA3174D03D0CE7090D76507C4274982A85FACF3EA51BEE6925B8F0FE
3 malicious · 3 files
PS1600d2f1f2a31008f9d1d18ca4d0b4443T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001
Shape
scr:ps1
malicious
1 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
"
huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential3 malicious · 3 files
PS1600d2f1f2a31008f9d1d18ca4d0b4443T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
"
huhuhuhuhuhuhuhuhuhuhu
600d2f1f2a31008f9d1d18ca4d0b4443 › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account