Malicious
PowerShell
MD5: b3d0935c69db44417bf933124e747e7d
Size: 65.22 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 63.7 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- dbc06ff81a23cddbdaaaee0838322a7ff554a61a19e0d7ba52fec6277aae5bf6
- MD5
- b3d0935c69db44417bf933124e747e7d
- Verdict
- Malicious
- File type
- PowerShell · 63.7 KB
Cite this report: https://app.malva.re/sha256/dbc06ff81a23cddbdaaaee0838322a7ff554a61a19e0d7ba52fec6277aae5bf6
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
65.22 KB · 65,215 B
First seen
2026-10-30 07:45 · 3 days ago
Last seen
2026-10-30 07:45 · 3 days ago
Last analysis
2026-10-30 07:45 · 3 days ago
Hashes
MD5
b3d0935c69db44417bf933124e747e7d
Sha1
001df7a5e96aaa491c3397fb343e1c2aea7ef26f
Sha256
dbc06ff81a23cddbdaaaee0838322a7ff554a61a19e0d7ba52fec6277aae5bf6
Sha384
73476e6b55aa4181aa164f0d1cb38005a7858f1b1072feeda261d4d19b1b0b2971889402dbf0dd0f9935a1cb034c0113
Sha512
1b8e7067099c9e641c9243fad80d0e810d0b57cd5e48a3469efa054dd20f4db0b5815bfc180bff94d4a0da50004a040126f63de03c5485e0591372b05aaa88d4
SSDeep
1536:VhteqAbPvAwgcQAqP91JjM3zodt8mk0Hnb9880:VXeq5P7W3zI8mk0HnyP
TLSH
C653C5B398EDC7F5290A3FBDAD0C05E4DA758516113E88ECA58E231A1072B78967E178
Detection
Symbol obfuscation
Low
8 malicious · 8 files
PS1b3d0935c69db44417bf933124e747e7dT1027 · T1059.001 · T1059.005
VBSb3d0935c69db44417bf933124e747e7d.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:ps1>scr:vbs>scr:ps1
malicious
3 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential