Malicious
PowerShell
MD5: cc5193b2f9fce6a3f807e12633308600
Size: 7.53 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 7.4 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files. It matches 7 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0
- MD5
- cc5193b2f9fce6a3f807e12633308600
- Verdict
- Malicious
- File type
- PowerShell · 7.4 KB
Cite this report: https://app.malva.re/sha256/c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
7.53 KB · 7,530 B
First seen
2026-11-04 08:45 · 54 minutes ago
Last seen
2026-11-04 08:45 · 54 minutes ago
Last analysis
2026-11-04 08:45 · 54 minutes ago
Hashes
MD5
cc5193b2f9fce6a3f807e12633308600
Sha1
585caf4d2f024e8e536cc6899ebbee8a1c28073c
Sha256
c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0
Sha384
1f66489d0302c498d2e4fc1440e93d90447a9ce9e0ba8bf701f836ffcf7c5ad7f710643ede8af486399acc4c5e793987
Sha512
7083165f6774a14d02101996958ecddb0842837922077118a3fc6e8024c32843c12f7acd54270bbb1bf02cad08bc018edfa3a9a95ab54a9412c63cd122e90c89
SSDeep
48:+aNdUgzUmTheZYN4Apia73Dem/eXJWQz2MWHZpdHofhMRQrUy2iDtCvRFujJ:+SdUgzUAh3+M39/WYPtZfmWqUFQJ
TLSH
26F1DCDD6C8A60689D73733C8B7FA018FB775A276206C600BD9D93502F7170492A9EED
3 malicious · 3 files
PS1cc5193b2f9fce6a3f807e12633308600T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001
Shape
scr:ps1
malicious
1 nodes