Malicious
c9d9a541e248df8728df6b82afa78b26
PowerShell
MD5: c9d9a541e248df8728df6b82afa78b26
Size: 7.54 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 7.4 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files. It matches 7 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5
- MD5
- c9d9a541e248df8728df6b82afa78b26
- Verdict
- Malicious
- File type
- PowerShell · 7.4 KB
Cite this report: https://app.malva.re/sha256/497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
7.54 KB · 7,536 B
First seen
2026-11-04 08:45 · an hour ago
Last seen
2026-11-04 08:45 · an hour ago
Last analysis
2026-11-04 08:45 · an hour ago
Hashes
MD5
c9d9a541e248df8728df6b82afa78b26
Sha1
14c6786a756caa05ef041943e38fad73efb29040
Sha256
497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5
Sha384
3fea391273e8dd0e56a64e4726b7db0b0b1f6b05204c380733a188c0df847e791021a37a12b848c4c5ae8fd0ded3e148
Sha512
afe924778cfe8f5a57427facaab75fbd59c4cca7cac6409c7648031ef29486eef69300be996f9081b517bab9a3d6a332b3342898af0b69026e4b96ea8e3b4d5d
SSDeep
48:5NdUgzUmTheZYN4Apia73Dem/eXJWQz2MWHZpdHofhMRQrUy2iDtCvRFujJ:/dUgzUAh3+M39/WYPtZfmWqUFQJ
TLSH
FFF1ECDD6C8A60689D73733C8B7FA01CFA775A276206C600BD9D93502F7170492A9EED
3 malicious · 3 files
PS1c9d9a541e248df8728df6b82afa78b26T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001
Shape
scr:ps1
malicious
1 nodes
3 malicious · 3 files
PS1c9d9a541e248df8728df6b82afa78b26T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account