Malicious
Malicious

dec016af4c8c7dd141216663e16e56fa

PowerShell
MD5: dec016af4c8c7dd141216663e16e56fa
Size: 11.02 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 dec016af4c8c7dd141216663e16e56fa
Sha1 3cea4a0aa7fcc6193454722609d811f62574f017
Sha256 957c3fc02297170cea63f95c640c63954774ed5b25be4bb9f40f14b9aba1e06b
Sha384 cccc23ef57c29f00ac513ea7ce47222ccc492f1ab07b99cbca4bf522f16bfd1b86f2626c4be5c661af2831c43766e0ac
Sha512 b228c61be85f72f4e6839afab349f16da677449ed2d03e6b7840441dd0b79d394f097c7fc58023644d93344af46da152caa579b06339f18b559eaf3d0a81cdf2
SSDeep 192:PY6uua9ArZzjPamI2/lu6tCAgBQn+9lN+pLSlyZoZwh7LHYua629C4LW4cuOmX8x:wDua9ArZ/Pah2/M6MAgB0+9L+5SaThXp
TLSH 31328A3CD6B1EDC4036F31D09A5A3F4620AD5B23F7B44B6CF9C148AA1868658DF3A19C
dec016af4c8c7dd141216663e16e56fa
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 1 STICH kept: 1
STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
1 / 1
Path scr:ps1~T1027~T1059.001>bin
Shape scr:ps1>bin
malicious 2 nodes
Deobfuscated PowerShell UNKNWOWNmalicious
= "Nehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
dec016af4c8c7dd141216663e16e56fa
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
No malware configuration was found at this point.
Deobfuscated PowerShell UNKNWOWNmalicious
= "Nehuhuhuhuhuhuhuhuhuhuhu
dec016af4c8c7dd141216663e16e56fa › [Base64-Block]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙