Malicious
PowerShell
MD5: 73429fb8257d43eed37d0d3594e732a3
Size: 141.04 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 137.7 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 7a2b8b6bdc0b266567580eb9bfc0546067b1b774c6002b1bb455ec95dc979fb6
- MD5
- 73429fb8257d43eed37d0d3594e732a3
- Verdict
- Malicious
- File type
- PowerShell · 137.7 KB
Cite this report: https://app.malva.re/sha256/7a2b8b6bdc0b266567580eb9bfc0546067b1b774c6002b1bb455ec95dc979fb6
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
141.04 KB · 141,040 B
First seen
2026-10-28 11:00 · 11 minutes ago
Last seen
2026-10-28 11:00 · 11 minutes ago
Last analysis
2026-10-28 11:01 · 10 minutes ago
Hashes
MD5
73429fb8257d43eed37d0d3594e732a3
Sha1
c0c06c7f9c437599a643f229dc4f740ec8d301c9
Sha256
7a2b8b6bdc0b266567580eb9bfc0546067b1b774c6002b1bb455ec95dc979fb6
Sha384
49ffc5f252f8ba98d438e92525b5297e8f04f360dfc3e13222a51eeba6d6b41e2deb2b60cc6f7a8da9ae3ab238f68cef
Sha512
bebcf15df165f637728d85ff27123c72af6a73a1c0ca532f462409ae3341d7206fee51500d9d0bcb1e1575e3c54ba8d92583a8ab0738e4d47cf857738bee4d75
SSDeep
3072:W3I6E8xYNureC7nPcaSqX2gviFBkjc6EM:+I6LreCTuZgRcG
TLSH
14D3E998D5E6D9378F490E59EF2E2F10E2B4611D2121E0BC95C83B9D320B958E67DB3C
Detection
Symbol obfuscation
Medium
8 malicious · 8 files
PS173429fb8257d43eed37d0d3594e732a3T1027 · T1059.001 · T1059.005
VBS73429fb8257d43eed37d0d3594e732a3.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:ps1>scr:vbs>scr:ps1
malicious
3 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential