Malicious
PowerShell
MD5: d86244c2ba2650996826613c4eef0719
Size: 113.64 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 111 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 20 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- a757b5be85411fa23be38861bb94ad201a394ec9d1c80038e250c065aeddd138
- MD5
- d86244c2ba2650996826613c4eef0719
- Verdict
- Malicious
- File type
- PowerShell · 111 KB
Cite this report: https://app.malva.re/sha256/a757b5be85411fa23be38861bb94ad201a394ec9d1c80038e250c065aeddd138
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
113.64 KB · 113,639 B
Hashes
MD5
d86244c2ba2650996826613c4eef0719
Sha1
04c9dc7ea419e4e3b497dc95c45cfb35b86af1e5
Sha256
a757b5be85411fa23be38861bb94ad201a394ec9d1c80038e250c065aeddd138
Sha384
e38fe45cbb4e479e2373cb84b3f671e7bf9afb7de16bced29bfc0dd64cb1ca6e145d0b610c0e418dafe511724a6786c0
Sha512
fd7703980d86e2c6f29934eae443cbb8faf8ff4375839efad1a24a770ff6f4497b2658355c61da797e2890f5907699b2c053a97725efdcff612172f9c8d4e51b
SSDeep
3072:B/prMlgYbGfQ9ezagCiD74WUspUX+cJMl6:T4G4EaAkWuXf
TLSH
F5B32935C91911760F427B9CBCA64671DA3C83058A3A89B0F5C9876D600DAECFB7D26F
4 malicious · 4 files
PS1d86244c2ba2650996826613c4eef0719T1027 · T1059.001 · T1059.007
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1059.007
Shape
scr:ps1
malicious
1 nodes
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential