Malicious
b3d0935c69db44417bf933124e747e7d
PowerShell
MD5: b3d0935c69db44417bf933124e747e7d
Size: 65.22 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 63.7 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- dbc06ff81a23cddbdaaaee0838322a7ff554a61a19e0d7ba52fec6277aae5bf6
- MD5
- b3d0935c69db44417bf933124e747e7d
- Verdict
- Malicious
- File type
- PowerShell · 63.7 KB
Cite this report: https://app.malva.re/sha256/dbc06ff81a23cddbdaaaee0838322a7ff554a61a19e0d7ba52fec6277aae5bf6
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
65.22 KB · 65,215 B
First seen
2026-10-30 07:45 · 3 days ago
Last seen
2026-10-30 07:45 · 3 days ago
Last analysis
2026-10-30 07:45 · 3 days ago
Hashes
MD5
b3d0935c69db44417bf933124e747e7d
Sha1
001df7a5e96aaa491c3397fb343e1c2aea7ef26f
Sha256
dbc06ff81a23cddbdaaaee0838322a7ff554a61a19e0d7ba52fec6277aae5bf6
Sha384
73476e6b55aa4181aa164f0d1cb38005a7858f1b1072feeda261d4d19b1b0b2971889402dbf0dd0f9935a1cb034c0113
Sha512
1b8e7067099c9e641c9243fad80d0e810d0b57cd5e48a3469efa054dd20f4db0b5815bfc180bff94d4a0da50004a040126f63de03c5485e0591372b05aaa88d4
SSDeep
1536:VhteqAbPvAwgcQAqP91JjM3zodt8mk0Hnb9880:VXeq5P7W3zI8mk0HnyP
TLSH
C653C5B398EDC7F5290A3FBDAD0C05E4DA758516113E88ECA58E231A1072B78967E178
Detection
Symbol obfuscation
Low
8 malicious · 8 files
PS1b3d0935c69db44417bf933124e747e7dT1027 · T1059.001 · T1059.005
VBSb3d0935c69db44417bf933124e747e7d.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:ps1>scr:vbs>scr:ps1
malicious
3 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential8 malicious · 8 files
PS1b3d0935c69db44417bf933124e747e7dT1027 · T1059.001 · T1059.005
VBSb3d0935c69db44417bf933124e747e7d.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
b3d0935c69db44417bf933124e747e7d
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account