Malicious
dec016af4c8c7dd141216663e16e56fa
PowerShell
MD5: dec016af4c8c7dd141216663e16e56fa
Size: 11.02 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
11.02 KB · 11,022 B
First seen
2026-07-13 15:04 · 3 months ago
Last seen
2026-07-13 15:04 · 3 months ago
Last analysis
2026-07-13 15:10 · 3 months ago
Hashes
MD5
dec016af4c8c7dd141216663e16e56fa
Sha1
3cea4a0aa7fcc6193454722609d811f62574f017
Sha256
957c3fc02297170cea63f95c640c63954774ed5b25be4bb9f40f14b9aba1e06b
Sha384
cccc23ef57c29f00ac513ea7ce47222ccc492f1ab07b99cbca4bf522f16bfd1b86f2626c4be5c661af2831c43766e0ac
Sha512
b228c61be85f72f4e6839afab349f16da677449ed2d03e6b7840441dd0b79d394f097c7fc58023644d93344af46da152caa579b06339f18b559eaf3d0a81cdf2
SSDeep
192:PY6uua9ArZzjPamI2/lu6tCAgBQn+9lN+pLSlyZoZwh7LHYua629C4LW4cuOmX8x:wDua9ArZ/Pah2/M6MAgB0+9L+5SaThXp
TLSH
31328A3CD6B1EDC4036F31D09A5A3F4620AD5B23F7B44B6CF9C148AA1868658DF3A19C
7 malicious · 7 files
PS1dec016af4c8c7dd141216663e16e56faT1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001>bin
Shape
scr:ps1>bin
malicious
2 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
= "Nehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential7 malicious · 7 files
PS1dec016af4c8c7dd141216663e16e56faT1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
BIN[Base64-Block]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
= "Nehuhuhuhuhuhuhuhuhuhuhu
dec016af4c8c7dd141216663e16e56fa › [Base64-Block]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account