Malicious
f6f6b0f2099eafdd1af8ac14e5f5b6fe
PowerShell
MD5: f6f6b0f2099eafdd1af8ac14e5f5b6fe
Size: 127.79 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 124.8 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- b56369dd64618ec88bd267c452f826018388878c0e2c6599cdffd480597b45a2
- MD5
- f6f6b0f2099eafdd1af8ac14e5f5b6fe
- Verdict
- Malicious
- File type
- PowerShell · 124.8 KB
Cite this report: https://app.malva.re/sha256/b56369dd64618ec88bd267c452f826018388878c0e2c6599cdffd480597b45a2
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
127.79 KB · 127,785 B
First seen
2026-10-28 11:00 · 21 minutes ago
Last seen
2026-10-28 11:00 · 21 minutes ago
Last analysis
2026-10-28 11:01 · 21 minutes ago
Hashes
MD5
f6f6b0f2099eafdd1af8ac14e5f5b6fe
Sha1
9a6c80a0135ec5dc6b6bcc84c2f57716c546bec6
Sha256
b56369dd64618ec88bd267c452f826018388878c0e2c6599cdffd480597b45a2
Sha384
3a626fcbcb1b8364424aaaa2b4d3e4b1eedcc5d53541f10e9de63a8a1bd46a0141878ae5b4304b4654d30d185a21e32b
Sha512
e0d0a822df979d0d374a2bd45d93f9c537fac79a6a549030a0f034a673f97a90c929af5a7dc2ac6310c968617ab287e749cde6c9a00266f4b6672d041079253d
SSDeep
1536:VwGPSHxNy8lbQ1rWLRZnX7L77QC4AhcRzvFsSBhXDIKhDRWGX0hI3nqWY9BnBxI:eG6HSqUk1ZX7L6R5sS7XEAD0G02qzxI
TLSH
EFC37030FBC40B3BC9E63B9AAD5085D5E67C8515C32B40DFA68A121ADCC25D8F77A934
Detection
Symbol obfuscation
Low
8 malicious · 8 files
PS1f6f6b0f2099eafdd1af8ac14e5f5b6feT1027 · T1059.001 · T1059.005
VBSf6f6b0f2099eafdd1af8ac14e5f5b6fe.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:ps1>scr:vbs>scr:ps1
malicious
3 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential8 malicious · 8 files
PS1f6f6b0f2099eafdd1af8ac14e5f5b6feT1027 · T1059.001 · T1059.005
VBSf6f6b0f2099eafdd1af8ac14e5f5b6fe.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
No malware configuration was found at this point.
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
f6f6b0f2099eafdd1af8ac14e5f5b6fe
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account