Malicious
PowerShell
MD5: fa4ad5b915b66d36adbeaf95ea11b8cd
Size: 51.18 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
This sample is a 50 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 8 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1059.001. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 409f9a9781841428b4b09a8ef4ea49b4b26643102203676630a51a195eb8bd17
- MD5
- fa4ad5b915b66d36adbeaf95ea11b8cd
- Verdict
- Malicious
- File type
- PowerShell · 50 KB
Cite this report: https://app.malva.re/sha256/409f9a9781841428b4b09a8ef4ea49b4b26643102203676630a51a195eb8bd17
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
51.18 KB · 51,177 B
First seen
2026-11-04 11:00 · an hour ago
Last seen
2026-11-04 11:00 · an hour ago
Last analysis
2026-11-04 11:01 · an hour ago
Hashes
MD5
fa4ad5b915b66d36adbeaf95ea11b8cd
Sha1
e80f6943e9fb49489f8a1249bf2ef1abb28a3fbe
Sha256
409f9a9781841428b4b09a8ef4ea49b4b26643102203676630a51a195eb8bd17
Sha384
37b7111e54f56f3289cd877a98095f8629e76ff556271b6738f3193f59853bce47f84a6f00e016d3004d9e0801d70d31
Sha512
7e514559248b5b251fde0d53295b730b82d0e0df48720e2b6748839f7c203fe755e4764d052df0bf5f3ef83c8de92f23cc10590bb8d4c51c2a75d9c4a726bd7d
SSDeep
768:Zk+CJOvQIF5CX8neA1OZ3brdUAOgTHOB4qJhx0kVQ7ZXV9F7PoBC:Z2EIID/HOlrOgTHOBh77VaZXZ7Po0
TLSH
91335D72DC1B0E2A8C4A37E5ED081A54C5EA846181B331B4BED87739264767CF7BC71A
4 malicious · 4 files
PS1fa4ad5b915b66d36adbeaf95ea11b8cdT1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001
Shape
scr:ps1
malicious
1 nodes