Malicious
8f4771a4c4a22eaf236ecdd57ed53d0f
PowerShell
MD5: 8f4771a4c4a22eaf236ecdd57ed53d0f
Size: 65.75 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 64.2 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 8 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- c826170c2e0760a33e303402c5a25b9945da015d1e06fa8b18a537acbb8b3016
- MD5
- 8f4771a4c4a22eaf236ecdd57ed53d0f
- Verdict
- Malicious
- File type
- PowerShell · 64.2 KB
Cite this report: https://app.malva.re/sha256/c826170c2e0760a33e303402c5a25b9945da015d1e06fa8b18a537acbb8b3016
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
65.75 KB · 65,747 B
Hashes
MD5
8f4771a4c4a22eaf236ecdd57ed53d0f
Sha1
ce4889e911a31cec71aeb56244119859955629b0
Sha256
c826170c2e0760a33e303402c5a25b9945da015d1e06fa8b18a537acbb8b3016
Sha384
8766ad98a5840e3da0e2f2f5a6e6e21a01bdd6a671689f0984810b9dd3b08fa97efc6bed974f1c107b6b3cb06b7b68a3
Sha512
a31261bb81c93769ef883b36e96ce53816973b518d0d0708c91aa686a81ae7657d30171d23c87fe92a41fd81df0de7bd68d4aefe62e8c964df154d08a1d26cfd
SSDeep
768:VvZ8RBirjbqGTEZIJP/3vATwpI7ffQpqZ8ZDhTZ/3zoXeZpGLHnc3E7w5xc:Vrrjb7b1A3QpP13zoXqpEHncUme
TLSH
D353F717DCD21E77098226D96DCB161280F8B11A0E22E0ECBD99130B1C9999FD7F9F69
4 malicious · 4 files
PS18f4771a4c4a22eaf236ecdd57ed53d0fT1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001
Shape
scr:ps1
malicious
1 nodes
4 malicious · 4 files
PS18f4771a4c4a22eaf236ecdd57ed53d0fT1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account