Malicious
73429fb8257d43eed37d0d3594e732a3
PowerShell
MD5: 73429fb8257d43eed37d0d3594e732a3
Size: 141.04 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 137.7 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 7a2b8b6bdc0b266567580eb9bfc0546067b1b774c6002b1bb455ec95dc979fb6
- MD5
- 73429fb8257d43eed37d0d3594e732a3
- Verdict
- Malicious
- File type
- PowerShell · 137.7 KB
Cite this report: https://app.malva.re/sha256/7a2b8b6bdc0b266567580eb9bfc0546067b1b774c6002b1bb455ec95dc979fb6
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
141.04 KB · 141,040 B
First seen
2026-10-28 11:00 · 22 minutes ago
Last seen
2026-10-28 11:00 · 22 minutes ago
Last analysis
2026-10-28 11:01 · 21 minutes ago
Hashes
MD5
73429fb8257d43eed37d0d3594e732a3
Sha1
c0c06c7f9c437599a643f229dc4f740ec8d301c9
Sha256
7a2b8b6bdc0b266567580eb9bfc0546067b1b774c6002b1bb455ec95dc979fb6
Sha384
49ffc5f252f8ba98d438e92525b5297e8f04f360dfc3e13222a51eeba6d6b41e2deb2b60cc6f7a8da9ae3ab238f68cef
Sha512
bebcf15df165f637728d85ff27123c72af6a73a1c0ca532f462409ae3341d7206fee51500d9d0bcb1e1575e3c54ba8d92583a8ab0738e4d47cf857738bee4d75
SSDeep
3072:W3I6E8xYNureC7nPcaSqX2gviFBkjc6EM:+I6LreCTuZgRcG
TLSH
14D3E998D5E6D9378F490E59EF2E2F10E2B4611D2121E0BC95C83B9D320B958E67DB3C
Detection
Symbol obfuscation
Medium
8 malicious · 8 files
PS173429fb8257d43eed37d0d3594e732a3T1027 · T1059.001 · T1059.005
VBS73429fb8257d43eed37d0d3594e732a3.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:ps1>scr:vbs>scr:ps1
malicious
3 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential8 malicious · 8 files
PS173429fb8257d43eed37d0d3594e732a3T1027 · T1059.001 · T1059.005
VBS73429fb8257d43eed37d0d3594e732a3.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
73429fb8257d43eed37d0d3594e732a3
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account