Malicious PowerShell analysis – 1c70d6c57ca8

Ctrl + scroll to zoom · drag to pan

This sample is a 5.2 MB PowerShell for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 26 embedded or derived files. It matches 51 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: 1c70d6c57ca876bbe39d09ef8c7a4293910271a13707109712543fe2a28e9bfc
MD5: a82457fed3f9f435778b6f89172ce519
Verdict: Malicious
File type: PowerShell · 5.2 MB
MITRE ATT&CK: T1027 T1059.001

Cite this report: https://app.malva.re/sha256/1c70d6c57ca876bbe39d09ef8c7a4293910271a13707109712543fe2a28e9bfc

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

PowerShell Script

Size

5.49 MB · 5,493,061 B

First seen

2026-07-27 06:32 · 3 months ago

Last seen

2026-07-27 06:32 · 3 months ago

Last analysis

2026-07-27 06:32 · 3 months ago

Hashes

MD5 a82457fed3f9f435778b6f89172ce519 Sha1 41f7874c4287aa3005749be207fd41e934f3e61c Sha256 1c70d6c57ca876bbe39d09ef8c7a4293910271a13707109712543fe2a28e9bfc Sha384 225b37e62aff6eb4e38ad81679ce80f7f6f3082e1fe0ce4908226b3e7438d7b3a66197884692f08e86473dcefb3fb8a0 Sha512 e215c813995c1b1981b94755e140cfc22bece4660d548197349e9b00ed0fa889e96db2ad0d7d4e50dbfe739340678ea8ae88ff9e3c88d7be80ef24942ff960ed SSDeep 24576:s+9fxoTL78pFibaIEazi9tTtcb3eugEboehk8OtxNjiq0sr3FOEZuGA/OUzmmsW8:RxwrKiK+e TLSH D3469F516E5859F5EF8C2A0E90AE6F1D87F042176A33706BFB41DF04BEDA241864B21F

26 malicious · 27 files

PS1a82457fed3f9f435778b6f89172ce519

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

BIN[Base64-Block]

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:ps1~T1027~T1059.001

Shape scr:ps1

malicious 1 nodes