Malicious
Malicious

eaa96f1171820db260f58d4a5a6d395f

PowerShell
MD5: eaa96f1171820db260f58d4a5a6d395f
Size: 155.77 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan

This sample is a 152.1 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
0f1b4e735fed76b599c8916cec9a9676abaffed6c2d050e371d5113d0b2df11b
MD5
eaa96f1171820db260f58d4a5a6d395f
Verdict
Malicious
File type
PowerShell · 152.1 KB
MITRE ATT&CK
T1027T1059.001T1059.005

Cite this report: https://app.malva.re/sha256/0f1b4e735fed76b599c8916cec9a9676abaffed6c2d050e371d5113d0b2df11b

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
VBScript file
Size
155.77 KB · 155,772 B
First seen
2026-10-28 11:00 · 16 minutes ago
Last seen
2026-10-28 11:00 · 16 minutes ago
Last analysis
2026-10-28 11:01 · 16 minutes ago
Hashes
MD5 eaa96f1171820db260f58d4a5a6d395f Sha1 637fd138c84726d48ae30741d77ffddc47926009 Sha256 0f1b4e735fed76b599c8916cec9a9676abaffed6c2d050e371d5113d0b2df11b Sha384 8c7cf4586c3f443f9e7d0eeaf4f82eef70ea14847e3794ca46eee9c0b6df493fe3bde162586745ea28be16066c44b67a Sha512 f559edf142811bc0bfca01edc255add24e5161550586845bb843bafe39e5fac9a6fada3898b08018f6bb1732ba15ee86575504565873d37107dda180430805f1 SSDeep 3072:rna1iHpGyZgCoR7TbuCNsS38X6X9g0mXkla:La1iHMPR7h/3ZXTo TLSH 3CE384D2DCFC19B6C5C78AED9D0C2ED8D4B48D1A393940ABFD58132EA042A64D7BD934
Detection
Symbol obfuscation
Low

8 malicious · 8 files
PS1eaa96f1171820db260f58d4a5a6d395f
VBSeaa96f1171820db260f58d4a5a6d395f.deobfuscated.vbs
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape scr:ps1>scr:vbs>scr:ps1
malicious 3 nodes

Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

8 malicious · 8 files
PS1eaa96f1171820db260f58d4a5a6d395f
VBSeaa96f1171820db260f58d4a5a6d395f.deobfuscated.vbs
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
No malware configuration was found at this point.

Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
eaa96f1171820db260f58d4a5a6d395f
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙