Malicious
85b4d31e0d40725175b4f438e19fdab7
PowerShell
MD5: 85b4d31e0d40725175b4f438e19fdab7
Size: 6.92 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 6.8 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted a malware configuration (URLs (emulation JS)). It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.007 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 95736250c52cdfc62bd5891f8fa77a441c91e85c8bdcb035c5b1cca87a32c085
- MD5
- 85b4d31e0d40725175b4f438e19fdab7
- Verdict
- Malicious
- File type
- PowerShell · 6.8 KB
Cite this report: https://app.malva.re/sha256/95736250c52cdfc62bd5891f8fa77a441c91e85c8bdcb035c5b1cca87a32c085
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
JavaScript file
Size
6.92 KB · 6,924 B
First seen
2026-11-02 07:15 · 2 hours ago
Last seen
2026-11-02 07:15 · 2 hours ago
Last analysis
2026-11-02 07:15 · 2 hours ago
Hashes
MD5
85b4d31e0d40725175b4f438e19fdab7
Sha1
f369ae89d1be25a3a4fb5d6d85b933a5630cdb1f
Sha256
95736250c52cdfc62bd5891f8fa77a441c91e85c8bdcb035c5b1cca87a32c085
Sha384
370448a0cf2ea6f5930400a1aa54a361ec99f28d58f9deb0876ce93944e8a179aa5d43f933e35c14262561c6ede04a3e
Sha512
5dcd9b0b85e34c8de300b4d4dc4bf046095d8c55198439605833be735f4ed420701dff4102396de6424b9d253905bd854c4b2f6dbde4fabde4e2baf777e9ac7c
SSDeep
96:AhjMuKsJA2MyCrKYFf19D2tJ2iK5sBQFHz0todYKJ7A9N:I8sA+CrK43unbdf
TLSH
D7E1BE8DAC42606989B7733E8B6F8508EBA349230202C255BDACD2555F7146C82E8EFD
1 malicious · 1 file
PS185b4d31e0d40725175b4f438e19fdab7T1105 · T1059.007
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1059.007~T1105
Shape
scr:ps1
technique1 nodes
| Config. Field | Value |
|---|---|
| URL (emulation JS) #1 | https:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
URLs in JS Code - #1
URIsuspect
https:huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential1 malicious · 1 file
PS185b4d31e0d40725175b4f438e19fdab7T1105 · T1059.007
| Config. Field | Value |
|---|---|
| URL (emulation JS) #1 | https:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
85b4d31e0d40725175b4f438e19fdab7
URLs in JS Code - #1
URIsuspect
https:huhuhuhuhuhuhu
85b4d31e0d40725175b4f438e19fdab7
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account