Malicious
6908e14321351e2ff8facc3e0d596006
PowerShell
MD5: 6908e14321351e2ff8facc3e0d596006
Size: 4.08 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 4 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 8 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 9d81c29ec25c73da97aeac0b1070a01e4eb9e7c310597ce70c54221eecf9ee17
- MD5
- 6908e14321351e2ff8facc3e0d596006
- Verdict
- Malicious
- File type
- PowerShell · 4 KB
Cite this report: https://app.malva.re/sha256/9d81c29ec25c73da97aeac0b1070a01e4eb9e7c310597ce70c54221eecf9ee17
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
4.08 KB · 4,084 B
Hashes
MD5
6908e14321351e2ff8facc3e0d596006
Sha1
71c63e3f6074fce186aa208f0038dbebf650d05e
Sha256
9d81c29ec25c73da97aeac0b1070a01e4eb9e7c310597ce70c54221eecf9ee17
Sha384
cae66f859c12f10f16c48ccd32037dda3762dfc85b7946ec0de65aaf31c4fe3a9f1f493b5c18761c5d8bb296baec1f84
Sha512
54502ebbb43d6ee962d74cf074579e26726bb6c6fc12c62add11d20f0158e3d533d4ad7f2b53df72b03ec299aac44fba4d254aadda3162695d3b23bce051a74e
SSDeep
96:u2e9RwpgLx9+o0MTjw/6RPZPcgQZ8cTbGwPdsRIBO3+0Vbim2eE:u2Uao07CPZ/UlmOE+O39Rim2j
TLSH
B2816D243532861BC7C430DEC8588F644B1E266D8198ACE6D29AF70065AC7E894EE4C6
4 malicious · 4 files
PS16908e14321351e2ff8facc3e0d596006T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001
Shape
scr:ps1
malicious
1 nodes
4 malicious · 4 files
PS16908e14321351e2ff8facc3e0d596006T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account