f3ed17111f9c2bd6186c1fefd33f34f1

PowerShell

MD5: f3ed17111f9c2bd6186c1fefd33f34f1

Size: 2.73 KB

application/x-powershell

Ctrl + scroll to zoom · drag to pan

This sample is a 2.7 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 1 embedded or derived file and a malware configuration (URLs in PowerShell). It matches 4 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: 96f7d97b54a2831d82bf6d0bed7bf8085dcfd22de94dc45a60a1a4dd52826b1e
MD5: f3ed17111f9c2bd6186c1fefd33f34f1
Verdict: Malicious
File type: PowerShell · 2.7 KB
MITRE ATT&CK: T1027 T1059.001 T1105

Cite this report: https://app.malva.re/sha256/96f7d97b54a2831d82bf6d0bed7bf8085dcfd22de94dc45a60a1a4dd52826b1e

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

PowerShell Script

Size

2.73 KB · 2,734 B

First seen

2026-10-27 05:45 · 2 hours ago

Last seen

2026-10-27 05:45 · 2 hours ago

Last analysis

2026-10-27 05:45 · 2 hours ago

Hashes

MD5 f3ed17111f9c2bd6186c1fefd33f34f1 Sha1 6c4c2f9c2abffd911552d82c21844cb97ab2f05d Sha256 96f7d97b54a2831d82bf6d0bed7bf8085dcfd22de94dc45a60a1a4dd52826b1e Sha384 657daeca3d55aba02e6208c11785b31ab170d2e07acaea97f354a785adbcba8a175a2bbd63a122de2a23b1eadbad0b7d Sha512 52f45f850ca4cf3923cbcae4fcefe2e3c4fc29e292999c5b16150f96a347ac165c1c67894fa275aa9d82c53f0f35b0671ae7ece57f30489d39a1e0c83657f2cb SSDeep 48:101sXyQ9oQ9AXNYXZlSCInX3idfd+wWPVWKj6uQJGAHta0Pzd3+dKuSG:1hCdjlnni9d5AauQ4AHtpl+dKuSG TLSH 7051753A7193126459421763CD8769E12F2F00A3112AA10DB4FCC2D95FE76ABC346EF3

2 malicious · 2 files

PS1f3ed17111f9c2bd6186c1fefd33f34f1

PS1[Deobfuscated PS]

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:ps1~T1027~T1059.001~T1105

Shape scr:ps1

malicious 1 nodes

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

URL in PowerShell #1 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

2 malicious · 2 files

PS1f3ed17111f9c2bd6186c1fefd33f34f1

PS1[Deobfuscated PS]

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

URL in PowerShell #1 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

f3ed17111f9c2bd6186c1fefd33f34f1

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

f3ed17111f9c2bd6186c1fefd33f34f1

Overview

Summary by MalvaGPT

Characteristics

File Structure

Malware Configuration — URLs in PowerShell1

Artefacts1