Malicious
Malicious

fc235ed3b6baacc6a7845966f4547a34

Share on LinkedIn
Print
PowerShell
MD5: fc235ed3b6baacc6a7845966f4547a34
Size: 142.77 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan

This sample is a 139.4 KB PowerShell classified as malicious by Malva.RE. Static analysis extracted 7 embedded or derived files. It matches 13 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
b43a005188f195683c34d9ea85522fe1563ed91adf0b9df9b65d77dab8620e68
MD5
fc235ed3b6baacc6a7845966f4547a34
Verdict
Malicious
File type
PowerShell · 139.4 KB
MITRE ATT&CK
T1027T1059.001T1059.005

Cite this report: https://app.malva.re/sha256/b43a005188f195683c34d9ea85522fe1563ed91adf0b9df9b65d77dab8620e68

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
PowerShell Script
Size
142.77 KB · 142,766 B
First seen
2026-10-28 11:00 · 11 minutes ago
Last seen
2026-10-28 11:00 · 11 minutes ago
Last analysis
2026-10-28 11:01 · 11 minutes ago
Hashes
MD5 fc235ed3b6baacc6a7845966f4547a34 Sha1 a1239a1179b1082011e744156f33e9ab0fd9168c Sha256 b43a005188f195683c34d9ea85522fe1563ed91adf0b9df9b65d77dab8620e68 Sha384 4f6280bb0ada94dd931230959bb55a4486f779c2cb1bbc2d6b1cfeecc77b44562fda93b557bc5cca3c991b9347729676 Sha512 9d665ab4c8c1f38e1e65ce55ac3935274ea5cef12bd2ca2ad3870924f7c5f83cb874ebbdcd469b7ddc3dab508794ba8bb3b6214bc26b421326214131dff195f2 SSDeep 1536:CPaBdGxFBhBvL46amOw+6yGGnngm09dMdUtoYS2CXGia+0a5jngYevK5c:CPaBd8P5RamOx6yddhYSDXGF+1Rncye TLSH A6D3D818BFE486BDA963AE5FE98205508874C91E093360BCF5681FBD3C2B71C967D1B4
Detection
Symbol obfuscation
Low

8 malicious · 8 files
PS1fc235ed3b6baacc6a7845966f4547a34
VBSfc235ed3b6baacc6a7845966f4547a34.deobfuscated.vbs
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001
Shape scr:ps1>scr:vbs>scr:ps1
malicious 3 nodes

Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙