Malicious
PowerShell
MD5: eaa96f1171820db260f58d4a5a6d395f
Size: 155.77 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 152.1 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 0f1b4e735fed76b599c8916cec9a9676abaffed6c2d050e371d5113d0b2df11b
- MD5
- eaa96f1171820db260f58d4a5a6d395f
- Verdict
- Malicious
- File type
- PowerShell · 152.1 KB
Cite this report: https://app.malva.re/sha256/0f1b4e735fed76b599c8916cec9a9676abaffed6c2d050e371d5113d0b2df11b
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
155.77 KB · 155,772 B
Hashes
MD5
eaa96f1171820db260f58d4a5a6d395f
Sha1
637fd138c84726d48ae30741d77ffddc47926009
Sha256
0f1b4e735fed76b599c8916cec9a9676abaffed6c2d050e371d5113d0b2df11b
Sha384
8c7cf4586c3f443f9e7d0eeaf4f82eef70ea14847e3794ca46eee9c0b6df493fe3bde162586745ea28be16066c44b67a
Sha512
f559edf142811bc0bfca01edc255add24e5161550586845bb843bafe39e5fac9a6fada3898b08018f6bb1732ba15ee86575504565873d37107dda180430805f1
SSDeep
3072:rna1iHpGyZgCoR7TbuCNsS38X6X9g0mXkla:La1iHMPR7h/3ZXTo
TLSH
3CE384D2DCFC19B6C5C78AED9D0C2ED8D4B48D1A393940ABFD58132EA042A64D7BD934
Detection
Symbol obfuscation
Low
8 malicious · 8 files
PS1eaa96f1171820db260f58d4a5a6d395fT1027 · T1059.001 · T1059.005
VBSeaa96f1171820db260f58d4a5a6d395f.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:ps1>scr:vbs>scr:ps1
malicious
3 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential