Malicious
PowerShell
MD5: 6122947ec95d54870431828e2ac8138e
Size: 59.44 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 58 KB PowerShell for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 3 embedded or derived files. It matches 9 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 039a23b7beb862ceb398bc949820a9d86742fb440de73b5f9bfd935c4c28ac18
- MD5
- 6122947ec95d54870431828e2ac8138e
- Verdict
- Malicious
- File type
- PowerShell · 58 KB
Cite this report: https://app.malva.re/sha256/039a23b7beb862ceb398bc949820a9d86742fb440de73b5f9bfd935c4c28ac18
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
59.44 KB · 59,435 B
First seen
2026-10-30 09:00 · an hour ago
Last seen
2026-10-30 09:00 · an hour ago
Last analysis
2026-10-30 09:00 · an hour ago
Hashes
MD5
6122947ec95d54870431828e2ac8138e
Sha1
9d9c1f6ff63ab5c0ab7ce4bd5fdea9e921db9770
Sha256
039a23b7beb862ceb398bc949820a9d86742fb440de73b5f9bfd935c4c28ac18
Sha384
6b2be7e0560d1538ad9d53a6ad8a2f971bdf9168e8fb09c44233633e74a3e67faef95a55702972c48a8b0c75273a8807
Sha512
0a18d082565bec614bc113a8c61a02408dde3cbd74af9dfddafcf9225faf3e25088f73258f050c1998955f47d9aa50a05961614d80fb21dfb645083e9ca38fba
SSDeep
768:EBzMiHiPsb8NtKfWJg/y/bPArd0wTDl5ZQD1b2t5pY43zoxMPHnp:EB+PsbSGsArzDlTq1y/3zoCPHnp
TLSH
F943D610DAD52EB50E72879CADCC2654C5F9891F013392ECE9DB070E102AD68E77EDB9
4 malicious · 4 files
PS16122947ec95d54870431828e2ac8138eT1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001
Shape
scr:ps1
malicious
1 nodes