Malicious
PowerShell
MD5: 6a57b16dc9ad17a89c3b0331259cbd4e
Size: 128.63 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 125.6 KB PowerShell classified as malicious by Malva.RE. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 74bcff72877197a25bfc0b81c4703568a10f57c8046f38ad899ef6cecfad2387
- MD5
- 6a57b16dc9ad17a89c3b0331259cbd4e
- Verdict
- Malicious
- File type
- PowerShell · 125.6 KB
Cite this report: https://app.malva.re/sha256/74bcff72877197a25bfc0b81c4703568a10f57c8046f38ad899ef6cecfad2387
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
JavaScript (reclassé : grammaire non-VBScript)
Size
128.63 KB · 128,630 B
First seen
2026-11-04 07:00 · 2 hours ago
Last seen
2026-11-04 07:00 · 2 hours ago
Last analysis
2026-11-04 07:00 · 2 hours ago
Hashes
MD5
6a57b16dc9ad17a89c3b0331259cbd4e
Sha1
5ddde1210d9fd4bed2fd2ab135ad9ea8809102b3
Sha256
74bcff72877197a25bfc0b81c4703568a10f57c8046f38ad899ef6cecfad2387
Sha384
c09fd7c637439e7566d4fb6b0087c1256dfca1a7415205d7bc4c23dd41a08abaff508c19a45caa8946c4d3942d5a8543
Sha512
50a3b2cc794b719c97227144c44d40b8ff50b8e40d1c8fc79f0b11d5d9dbd911a7dede2efe05ddb04f13ac121425699451f70eb0ae75c7ede81fe36967a29813
SSDeep
3072:9aUOeNZm6LQlLrNRiF/hHh2hvXA+gVX4vgl1etCB3b5:FOwRUl3NwF/L2hvh2P7B3V
TLSH
E4C36B30DA2126774F476F89FDA506E1C66CD315813344B4FAEA874D8009AECE7BD26E
1 malicious · 1 file
PS16a57b16dc9ad17a89c3b0331259cbd4eT1027 · T1059.001 · T1059.007
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1059.007
Shape
scr:ps1
technique1 nodes
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential