Malicious
929857700d7f39281030da554d621370
PowerShell
MD5: 929857700d7f39281030da554d621370
Size: 50.06 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 48.9 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 1bd6c6c129405106f36f587fd24ca4d80769a129d50b41f0b2ef652c6cf9e23d
- MD5
- 929857700d7f39281030da554d621370
- Verdict
- Malicious
- File type
- PowerShell · 48.9 KB
Cite this report: https://app.malva.re/sha256/1bd6c6c129405106f36f587fd24ca4d80769a129d50b41f0b2ef652c6cf9e23d
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
50.06 KB · 50,059 B
First seen
2026-11-04 11:00 · 2 hours ago
Last seen
2026-11-04 11:00 · 2 hours ago
Last analysis
2026-11-04 11:01 · 2 hours ago
Hashes
MD5
929857700d7f39281030da554d621370
Sha1
977a196fd0603e8eb2ed50854168f2825f3b51ff
Sha256
1bd6c6c129405106f36f587fd24ca4d80769a129d50b41f0b2ef652c6cf9e23d
Sha384
4f6808b067cc5a72daa2150cf1febe992bc92e5e1131aa64db3732f87803813dc72442b32b122cc5ec828bd7c1e0af6f
Sha512
b111e4de0ee4cbd879bc88cd079e5ec3f715babbc8b19c22bb1109e2ba6d8534c70502d62f6d4f63ed59a42cf326d3ed2d28f9b77ec1e27c9ff2082285d04b12
SSDeep
768:0koNHrTegaSITWPIydxvY6U6QNfEU9JhfON9MQNw409W7+oMVd8vR:0fr6gaDodJHQNfE+7O9Lw4r7+oM6R
TLSH
B9238C76CD165366881727FAFC485AB4C5F8A4620A1310B4BFDD738E2417A6CA37D10F
Detection
Symbol obfuscation
Medium
8 malicious · 8 files
PS1929857700d7f39281030da554d621370T1027 · T1059.001 · T1059.005
VBS929857700d7f39281030da554d621370.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:ps1>scr:vbs>scr:ps1
malicious
3 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential8 malicious · 8 files
PS1929857700d7f39281030da554d621370T1027 · T1059.001 · T1059.005
VBS929857700d7f39281030da554d621370.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
929857700d7f39281030da554d621370
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account