Extracted

• • Target
    fileview-directa.info.ps1
  • Size 636KB
  • SHA256 7773a920346edfad725390b7a4b303001130d1dc3f0427d585315e1a991bb52a
  • MD5 89766f538d53ac8b759758ac7156f5b0
  • SHA1 c310ba7adae7af3bcd1bfc37917afb85de96afdd
  • SHA512 f54025181d2c99b222a651fb5fcb28a070cf8df801b2e13d3d7a5464c37efc2a54dc06f726cc2f998c3a10eb5ff463cc533bcaf3f5b65d29528316c41e9d7b54
  • SSDEEP 12288:KhGanylx21bVh3aWT8dCWpODOfFnPICNaieRa6KudlfcUC6mcd3:8E2pVhKWQdCW4qNPICAsudlfuc9
  • TLSH
    T195D4231219E23E080BF8237B3467AF2C36A51F336604D5613F9594ECA55E79B0B8367E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2behavioral3behavioral4