Malicious
PowerShell
MD5: 9f50461038ae879b9469f5c0b8924483
Size: 133.45 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 130.3 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 889aa9be57f77c3ec1db06a90a12f48687e019593b5aeb65c86b62b09d51f567
- MD5
- 9f50461038ae879b9469f5c0b8924483
- Verdict
- Malicious
- File type
- PowerShell · 130.3 KB
Cite this report: https://app.malva.re/sha256/889aa9be57f77c3ec1db06a90a12f48687e019593b5aeb65c86b62b09d51f567
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
133.45 KB · 133,448 B
First seen
2026-10-28 11:00 · 12 minutes ago
Last seen
2026-10-28 11:00 · 12 minutes ago
Last analysis
2026-10-28 11:01 · 12 minutes ago
Hashes
MD5
9f50461038ae879b9469f5c0b8924483
Sha1
5da2a51e25748980f1fecae05a673f11f0364098
Sha256
889aa9be57f77c3ec1db06a90a12f48687e019593b5aeb65c86b62b09d51f567
Sha384
6bc6805316d328adf374685d32ced1ffb0bf977b207ca08adc1ce503f8aa5cf6d52077158be1a19f23d59a17c6c43fc6
Sha512
2e5931dbc6f2b132fc06ff8df6fc138e8f485fb5a5a2961a322c003027123d3d8db6d223e080e0f513f5bf3e392edd977e461bac6abf80a108c1788d2ddc7f03
SSDeep
3072:+XomLPbwrgkryPgNOYbRxSTX7NMGMDhRd6Qo:MomLz+sPVYmvNgRd2
TLSH
E6D33ED8DDF6AEB70DC28A9DAF08C55580BB451C312240DCE7C812F91329D9FA67ADE4
Detection
Symbol obfuscation
Low
8 malicious · 8 files
PS19f50461038ae879b9469f5c0b8924483T1027 · T1059.001 · T1059.005
VBS9f50461038ae879b9469f5c0b8924483.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:ps1>scr:vbs>scr:ps1
malicious
3 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential