Malicious
PowerShell
MD5: 7d86bc6518088113883ee0300f8775d6
Size: 76.11 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 74.3 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 5 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 2ae5934befa552216204cf388ed9b7da322e20fb02b906168fc151c75d3002fb
- MD5
- 7d86bc6518088113883ee0300f8775d6
- Verdict
- Malicious
- File type
- PowerShell · 74.3 KB
Cite this report: https://app.malva.re/sha256/2ae5934befa552216204cf388ed9b7da322e20fb02b906168fc151c75d3002fb
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
76.11 KB · 76,108 B
First seen
2026-10-31 07:45 · an hour ago
Last seen
2026-10-31 07:45 · an hour ago
Last analysis
2026-10-31 07:45 · an hour ago
Hashes
MD5
7d86bc6518088113883ee0300f8775d6
Sha1
0ecabd829e4de8da86519a862636928ae4f1b36d
Sha256
2ae5934befa552216204cf388ed9b7da322e20fb02b906168fc151c75d3002fb
Sha384
ce046923201d454bbea14558189641aa1ad9797f8a1ba41b964e2626aca9f579baaca99cfabb7b8b48ec4e3ad2cbc11a
Sha512
623797944617efc1835c27d87ae34cdba9986774ebdcd08d3ff9b079390f5c275843f0e385186cba240c13f568b33ae11645cb0123f52f376e066b4f792997b1
SSDeep
1536:2Mtb0yaFAYoe7wNw6j6TbTgEldr8BWkyujcdltOCM:rF0yZYoesNw6jKTvHyrOltM
TLSH
8973C6113BC5E6A5518E9D750D8A18167F98A13BC28D6C5C3BCCB5C8BF8387887ADC78
3 malicious · 3 files
PS17d86bc6518088113883ee0300f8775d6T1027 · T1059.001
BIN[Deobfuscated String]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001
Shape
scr:ps1
malicious
1 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
(?i)
huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
ise | huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential