SUSP_PS1_OBFUSC_FormatString_Mar22

Rule Info

Av Ratio
7.42
Score
70
Name
SUSP_PS1_OBFUSC_FormatString_Mar22
Minimum Yara
1.7
Required Modules
[]
Description
Detects light obfuscated powershell scripts based on certain format string characteristic
Reference
Internal Research
Date
2022-03-01
Tags
['T1086', 'OBFUS', 'SCRIPT', 'T1027', 'T1059_001', 'SUSP']
Rule Hash
964f7231b932e7f7fb70e2c382e2d550
Author
Paul Hager

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
19
Suspicious (< 10 engines)
132
Clean (0 engines)
10

Rule Matches

Positives
Hash
Total
Timestamp
VT
10
6eff6e68e093924733d8bbdd6ba95ed1a5feb5470751bb93bc30ef797719fbf1
56
2022-06-16 18:44:18
10
5966af18667ba133e67d07172ba3e733961ea509124a78e5eacbb11438889869
56
2022-06-16 18:43:02
2
f558d41b8b4bc5e997fe5d7a2f889b95db0793d2d5a83fe9951a810e9c84a3ad
55
2022-06-16 18:39:23
1
10d465b605a46399f0c6200676179f6aecaa67fc55051a0f95ffe0d19a54aac2
56
2022-06-13 23:41:36
2
5b55c378f493f3fcb0ae31579ed78125aed764ca1075bdbc2e46a5e414e5eb9a
55
2022-06-13 17:01:20
2
b912e7b3b20c5526d023604a1495052ac1b9a876b49b057caab8c0097754b966
54
2022-06-13 11:21:31
2
8aa00eaafd788f41ba126490cf02679ea353222019353f207559b45c8257159b
56
2022-06-12 15:40:44
4
9bdf59a34eefc55ea1c4889c217b00a4668797e2481cf18bca5e5a45b177266a
56
2022-06-12 15:31:15
3
3f2b5afdb5b3cf9d5293ac03426846d23a8dd13c5a16f64b81299adb0a622d81
56
2022-06-11 22:28:55
2
4436dac66da9e6d8a290e2b9437fa19f2b78dca25f47ced63ab0e2f6e0b5833c
56
2022-06-11 22:26:44
2
b357e6d099f5d4b05d7cb7db3a0a9828731b7c8a1ce8da8c298ccec6707f7850
56
2022-06-11 19:26:51
2
145cdfb24ddf59879ed6bfc2f019700ebc190cace4309dcdaf9e257de796091e
56
2022-06-11 19:23:39
1
cd0e5f4b19ee17ba2b37ce6114899da6b68d0a9507b182c4a34ba9368a9bbaa7
56
2022-06-11 19:19:37
1
36f37e9958dc2f08a21a0096af84683e1dd1b9aa4186a27ec055ad52795a938f
56
2022-06-11 00:56:20
2
9b22a51431a5a606b3a3d013d8862b4d66a3e6acfaa7860093a9392b502307f6
55
2022-06-09 22:56:21
3
4d81c0a9eabf8b809a42ce56c53e932f25d553ae4f2dd44c0d8d0393d6f7665b
56
2022-06-09 01:02:30
0
11e52b6688a0efb4da9030a0aa5dd3ff903ebb0e836e9c7c0320491157190402
56
2022-06-09 00:15:18
42
2459267409143a7723b6e0fea34ef8f4b4bc510ee37e48f422f3324d696aca18
59
2022-06-08 17:45:43
2
ec3c24a485db78cf0724fd063a4329e8a2c194d9c043000aa6442fef7141541b
55
2022-06-08 14:29:11
4
3eaa7b8348aafe3cad1f8a03e2b99691e7a0452447d9a88b18cef39229f45428
56
2022-06-08 11:18:09
2
c703e6be550416c386fa20a7f82c7fa9dd1b398a278bad8b805252a4ace542c7
56
2022-06-08 11:16:53
3
88c7226c10fd53f6ec822752de4d87a40420664d2bfbd824ef5bbefe113c7b3b
56
2022-06-07 20:06:46
0
2c3405ab58db32c0a277b7b6d08a730deb2a8e7fe0aa1d014b57d29c1d929030
56
2022-06-07 20:03:57
3
824eb9dc83a188d4fb207471f0b6ae51c22f9af35d453bdc0bf26277cc911cb4
56
2022-06-07 01:01:52
1
8b0d4bb530bac8d8c14d61727b5c3cf515e9f490fff04a7bd4c62e8c7a55caac
56
2022-06-06 17:12:10
1
01c9ec9e61dd85d30374e6f28aa8852a33ff9848e65b3891cff7353fbe17df03
56
2022-06-06 17:11:00
6
dcbba8b40dc9f25afec8b3103cbc2dd7a799c4adaec60a709193c5b502063330
55
2022-06-06 12:20:38
0
e2e2197d36b5e25e35d9ff8d4e1ab4791e2a73293a1e5a039e357c4eb1bda064
56
2022-06-06 06:28:29
29
2ba4d77b0082d5927e97564b62b2b89a7f2761dfd83b48ec90052bb0eb8dee97
58
2022-06-05 21:03:28
29
7bef2474af601dcfd48f4085fcb01d467fc1a759080428f018b99790e8b5074c
58
2022-06-05 20:52:58
0
c5001d801f350592b799366581798e99d1af433c6e519539b0397f6b3c246f33
55
2022-06-05 20:39:44
4
5fb28b8a1864344dcc02d985ec7cd0d017b6c2c69779dfb146d52777833b7284
56
2022-06-05 11:18:15
1
bc1d4f076a92b168c0863b4ce36cd63f6a69afbbce119bd5b53df518c1a7f8ba
55
2022-06-04 19:00:33
3
60b9e185de1443d4f0cf271131dd6fb988fe0262c63192efb6da338a45d4d57c
55
2022-06-04 18:58:28
2
4978426032dd3b400325b6e1b9beb561c8d8aac7476dbedd096dac8e6f801be4
56
2022-06-04 18:56:16
2
b9db7c3693ba54580fb9849791bb431716b742c38986bcd0c5954c23812dda09
57
2022-06-02 12:43:14
3
f5dc4c5d9c414516cf79355f2ebd193c6f4df5c0af8fdba4a6b2c927ce9dd47b
57
2022-06-02 11:53:31
3
d4bdc7f4594aeee6e7bd3cb497279568460046f25b749c8799c2ff344ca7b8eb
57
2022-06-02 11:52:18
2
39916752c9142203685f8445cce37399e087d90507c430a863e186d34fc7eddf
57
2022-06-02 09:12:41
3
3a76529cec23e12a45902c66fe2e59a92c3249e2425bb7058340844b71418e32
57
2022-06-02 00:53:00
1
ee056f2fcb94e5767c086ba0310212df55630d6114d3d5053e4b33a9fb141cb0
57
2022-06-01 20:43:05
1
782b3e73dd6632fb4a0c0920b9c0ccf0b1b66ae5aa17478f4a72916d59739145
57
2022-06-01 20:37:31
1
ed8c2ad285323c7371f9da7842ac396e1de550645abfed19290ec26be43bdeac
56
2022-06-01 20:36:24
1
25cb1f05cc84874893bb83007401c2bb0083d2f7c4d15ef0c7a8ffc76752682a
57
2022-06-01 20:36:24
1
b95959561d99cdc5b0964263d7661d952b521f61f3acf1734e7d4582bc329529
56
2022-06-01 20:36:23
1
8ae94e8ee501289404de7e029185c72edd9b6d1dd2d586a054adac5c213fd9fb
57
2022-06-01 20:36:23
1
fdc18c9ca0842a5af74ae271cf0a106a09e10d964b5e2ed80a134a3fad0e6946
57
2022-06-01 20:36:23
1
555466a433ed42d286800407500181c0aa333baac5b107a3b2b7d4df8304856d
57
2022-06-01 20:36:23
1
b0844da6e3e4b1d1cb597fbdcc84ff82e3f9be2ab9149a3739d3ebf2ea77ef49
57
2022-06-01 20:36:23
1
bbb0e57a4398cbf13796cb0dcc54ad228f0af90fe09e7237217cccf678a8a4e4
57
2022-06-01 20:36:23
1
83feba2622bb9a4bec14067d191008016a4a55f260cbf4469d9c0ed38751c424
57
2022-06-01 20:36:22
0
b1cba8748a3cdbaa534119ea0b1e886a565c98ae5231f6f27ad0923ac2c3cb45
57
2022-06-01 20:35:12
1
e3c8df8303d6c250f6244b3ddafe4384848185733d6302c0e20292c75e93f5a8
57
2022-06-01 20:34:09
1
ab3879079941b295d52416194c846703e4bd418341a4c7cc8536adeafa9b24fc
57
2022-06-01 20:32:58
1
5b2f0988a5fb4f1a59c43fa7812b54759a73220eb81d8584e786c73720e73659
56
2022-06-01 20:31:54
1
0c0bb17ec71ce4bcfcd74d8a5427c02481e1f2568d6a5b27a829212eee743345
57
2022-06-01 20:31:53
1
881d19059f5bd87db6e43323c3f76792da8622affbcf658073036eb65e8a383b
57
2022-06-01 20:31:53
1
a133b6243eff75a3f7725a707e6bc635fdcb8d8cf5c542ff7099770ee0393c19
56
2022-06-01 20:31:53
1
2380ae2a5d2bdbf2259ecb55fdff353b3c704c5fbb9851b10f8142893bee1e5f
57
2022-06-01 20:31:52
1
c2cb437b4533a4c53e26b40f92f8d43b2e09edba82fc4f67cbeab683b427d6c4
57
2022-06-01 20:31:52
1
f94c8b5287086aa93e1df2b40202a6c83b25506ed626820e2ad287f7a92f1643
57
2022-06-01 20:31:52
1
ceb9b225798b4bcb2f1c44d309b09fafdc18384b94d8a81b6ef3b4c32ec8bc75
57
2022-06-01 20:31:52
1
4cc8117b3ee66fd6d87355dff9e73eb1b872a9a262f6e2690e7d06505f6b9637
56
2022-06-01 20:31:51
3
1303df79176737c3711b672db8ee8c9ac1c1c52f82c0e03ee1c80c699e039e84
57
2022-05-30 20:06:54
8
e2d55d8de753c055b69d60a70f86a935df334096b3912c28f1778be99efbb6bb
56
2022-05-28 23:31:12
2
5eb6d3ae8896548b11dea154599e1e0a3ce3972982bc20e86869f24893185ef0
56
2022-05-28 21:36:03
3
d506fb16ceb9157402fdbd9b10b5c15d9722c1ea3b174d08296e30df580d74eb
57
2022-05-28 21:18:40
3
0c0f4e84be629746f737d84d54c1007d4a38699fcb8400f9ac8b91c7e81b83d8
55
2022-05-28 21:18:39
1
187fd4ce1c0bef318149d7a439362ed465957145cb3a491e806a1bd59cabed83
57
2022-05-28 21:15:28
3
347fb20f51b38b6f355f818095838fe778dd611b878a0dd5fa176aecc03db4d8
57
2022-05-28 21:12:20
3
d4032a74b70237bdb992ff6a93df6e2a6770bbe35b2052fe600e28de7fab2c10
57
2022-05-28 17:37:14
3
5711aba2dbb3ab23f7c85cf4c4c99e16c128b0521a4d2d25c4ae841f74e8884d
56
2022-05-28 17:21:43
1
9f0b7e819003d892b7baa992c56f173d56a9fd767c9ef8fcc4302c3ca6ee4a3d
57
2022-05-27 23:32:01
1
7d56c447eb077dcef5e3d42c9648c1a86ff97085ddcebe87ec3969082d1a8ae2
57
2022-05-27 23:12:46
1
d500a240471a5183ba3d70d5caf934e552cd07666a811e9a6414c6cd5e86e504
57
2022-05-27 23:06:19
1
2cde13e80096d28a667ea34160bced3e6589cda44588eeec82cf88902153f11a
56
2022-05-27 20:09:46
1
4986d7c2b30e953e5f75d9fb30d6842f266f1f35330251caa7076d11dbc0613e
56
2022-05-27 19:06:56
2
2cd4b9a29a8322ac146415708be0b362bdcdf1ec4b9e32c85729f0d72cc29ab9
57
2022-05-27 19:06:30
10
7332fc109161847c849ce518b04958b96f369f6338e66286cea49f9d4a3fdc70
58
2022-05-27 18:20:50
2
061ca834d8dc67339d6765f04d88377f6a835dd35d483980cdb608db7a3967c2
57
2022-05-27 17:45:04
4
5a2d86a71685fb7bf0e515eaea7a4017239c436b7f6debd0856fcac53324e20b
57
2022-05-27 17:39:44
3
ef836bda0e189cad50824f134d2eff9af1f632343dc1fb595169f04db92f182f
56
2022-05-27 17:38:42
4
e6f603a5feeca7101e64fa38722506c8172242026d5259cd7b3fca7cbbd6d6ad
57
2022-05-27 17:29:02
3
ae31ab9c550265d93a061992987347951224868e9ee6aff64582219360f9cd57
56
2022-05-27 17:16:32
4
bb10fae0c41fa01cd35e746a55f33239784bb10ed287ea442a6bf9287743c157
57
2022-05-27 11:11:46
3
c10139557377e19bf6002389cf46d8cf8e941c7dc9ce64622bfa09180d173527
57
2022-05-27 07:06:49
7
340e05dc5de222caf0def2acc431c9ebde76d12766f328ef264d8a66271ecd89
57
2022-05-27 05:06:10
4
72c8c0d7c25b69ad514966b92013381d3b257f465f93e2137bb227f88ab12c0e
57
2022-05-26 22:34:21
3
47bf97aaba882387d5ba1f47904310e5cbe44319aa7f924bec967d2b8ca2c4f9
56
2022-05-26 10:29:25
4
79a42cd2a11ca67991548010417df513dfa736a77f41c120ae1b7eadc7e14654
56
2022-05-26 06:21:19
0
35498758bb167420755863c1c33d2ad0478cc45f27d1dfb39eda52e078d03e0a
57
2022-05-26 02:13:38
1
901abb2936aa0701ee1a4518a7c393a5a645115367af7b3af0c7c13a6b65aa87
57
2022-05-25 20:14:37
1
bf9e710ad6a0f42f9b5ce901787975717a70a79e29fc555ba26fe096350294f1
57
2022-05-25 20:11:39
3
5c71ed9da734d2c5ca80a2b492d74b170f2ed58521b29f50d5532cca458965ba
57
2022-05-25 20:07:55
1
c7137676607cd52e7ed59106b2b841c10d5e4e289e78eb5e1bb96d35a7a421d2
57
2022-05-25 20:07:51
3
e895682d608a98561e36de86b08f1e336d00d69120daddb6431fc3e1c37e1252
57
2022-05-23 15:53:13
0
f5040e3318c41b2d85d2f85c933cf9ee5aa171f2343a7baed5761aea7977d0a2
56
2022-05-23 15:15:00
0
825d035d9ca026a8237ee287a5f710d64ddb0f2119b6c6ff79a6d12117dec4a4
57
2022-05-23 01:20:11
4
351031dfbf9cf4728c6b3b3d0170e3780eecab50970f75510e7dcd0863f1fa29
56
2022-05-21 19:36:37
1
dc3f886a6bff50a5b691cca18b14037030497c98a9530fcaa01ac192666e3164
57
2022-05-20 23:34:01
3
109e3effa2c3bb5e21d26804ec242e926f2ff5a9f069a7ee21cdb74b44feb7ce
57
2022-05-20 22:04:54
3
ec77fcf942c563553401e6fda9d67a7401cae6097e814bfd68210d3fa14ed116
57
2022-05-19 22:23:59
5
f949280e7076e3e7c9212e45c21c08f97ae0a87fe551f0a8ddc89fbbb1daa20a
57
2022-05-18 16:03:22
3
a93479bb17ac5b77d281b11fc6dc175ade76119bc2b0d7a5aaf235b4501f051e
57
2022-05-18 15:10:47
2
13b2c8554788b0bedb6139f83d9b524a8433244d8090eaceeaa1d8cb4c387f27
44
2022-05-17 19:44:14
0
53feb5e14635fde233d0f185ee25f575f17caf71218bfdb8a4f8fe6d82a119bb
57
2022-05-17 18:29:14
3
a1e7a1ed2ed5aa2605028139b5c5b3e8c1b24016f449c8717c9cdc753c5c6a43
58
2022-05-16 17:54:55
3
b79948ca5202595dc404adb647c9bce77e0335b38ddf64e934f4d3b39d702f0a
58
2022-05-16 11:23:02
2
2b5ab08c3ee1814154188f0bf3d6a77b0eb4c56ffe4edecd4e561ca9d721a636
58
2022-05-14 21:11:21
3
033c62d546b94042bdb65c5bac15375857ce7cc56e454080996db1fbee428a27
58
2022-05-14 18:58:56
2
d0afc1b0f4b57b159f5db5138072355518d3483c47ffd8cdc035b22e1d8a334b
58
2022-05-14 00:20:20
4
095f15feec9ae4044be736923f2989d5f72158c262eab7782cd113899cd45346
58
2022-05-13 13:36:28
9
ebe2c4cf05d0227d3cd971a61436a39bac8e32962abd053d29ec0d503de55ab2
58
2022-05-13 11:21:08
4
bf303ad7cf3166ea32517a378e2739759db5678496e7b78b4192b44afab3c1c6
57
2022-05-12 20:14:22
2
13694db2665b120af4052f2044aa693acbcafd81ea47c4d893685ef43fe12bda
58
2022-05-12 19:54:04
2
a0b50542886ee685127cf2298ff500de4731ff7f3ee7a5c1158de74fc5834443
58
2022-05-12 18:47:40
2
7ba7842fb8f466c365a03c01be669f45c36aab470ba50bf95bb86720c11962da
57
2022-05-12 16:23:01
10
2190f64653a334a50d6599bbed3e22677c27c970398a767d24bfd275ae0f276d
55
2022-05-12 14:43:38
12
39247922dd74aa78e6bcf510db1d0fb26af671841412924c27141d3acd924fa2
57
2022-05-12 14:34:44
11
9e869bab075b40c0d7541ca9c2d8705475fa45a07cf38ba83f1e13ccefdebeb5
58
2022-05-12 14:20:13
12
133c020d57100992db714941b7bb312e0ca0f25a109f386006e3a17c45105ee0
58
2022-05-12 13:40:20
3
0c7a624dc24779185a003d87843e1ef4bf2444ca87ffd1397446fca70c38bfd8
58
2022-05-12 05:59:08
3
5c868bb3c5a27a4dcd0ecefb4c7cfd269966b3ca27c60cba05c4fa08aba8fbe8
58
2022-05-10 15:39:48
13
5bae0576d86ec0844dfbe5211980efb4e3281ec1c5d73052411fdcb2954c78ec
58
2022-05-10 14:08:38
2
0510b87d63ec1ba0f1457c33d1c868e42b81aa2a4cb1b637a2ef803093657e88
58
2022-05-10 14:06:45
3
bf400b78090cbbc9ac1d22284b31263913dc46218451068a9bf2d846fc42fe38
57
2022-05-10 13:28:11
4
bde5efb31e02d22a8cb8b120bc76e42595026650fb1ca68833021ce6d09d6284
58
2022-05-10 08:47:13
1
b8d5da6c06e917d2bead0ed433a6a95b9260433edd31c047518e80109adc9e43
58
2022-05-09 22:38:21
14
fd297a9668189ba38285013c8ea62b5a0b1df3d38962e3a39905c433758319a5
58
2022-05-09 17:55:39
21
9307113c36e6da2e7ceeff5a556a067ca96f122bf0f7588d2d210858ae6e62a9
58
2022-05-07 11:36:26
3
0a5b7fa6bfeed0dc58bbcbcd2f92e8e10598fca1a2c346f145a28ede89009a38
58
2022-05-07 11:06:18
3
3a70249c4c8fccce4f1c1310d38667faabbd82585617aac857dffaf323ab8be2
58
2022-05-07 11:06:18
2
807e92df909e76a2abfb88dfd30029e5c3e3db1188090dc0c0b2cac5494003cc
57
2022-05-07 11:06:17
3
f9564d94562247c548b7c4d5a9cbfb5d27b47cc0c47c0142ac8f6b8458801093
57
2022-05-07 11:05:12
3
99e4a2dd1dcb352e72f67078017e7d5e164a3c814728424246c20e6926c5ac52
58
2022-05-07 09:30:30
3
57b6d6f1389b19e97d8fa1adbd4e580dbd33e8aea08d49aa5e0feffa221b4de6
58
2022-05-06 20:18:09
3
23dc03a902efb12dec52fbed2a6a0bc7a4e090dafc9d9b029e2964d8f66ae825
58
2022-05-06 20:12:33
3
5ffc8b316f6251b37bd233c5a10948518665233cc413bb12ffe8cdb18a49e92a
58
2022-05-06 13:16:01
5
28719062f1f416390a014faa960a95932e3da49037e3942e3e5e278ddd29d9a8
58
2022-05-06 12:50:59
4
d6d039d3fd418c71064cf12617c233e9c3e8896d3d9dbedd27640abd2b1ef506
57
2022-05-05 18:23:30
5
d8a9a469f183783905418cd1423049ef30888563f7fbbb5d8c8be26a7f37ac72
57
2022-05-05 18:16:09
3
3efbf279c1a3d9ec7b2dd5442747d1eeb06e1040d3adb68cdda88045ee77cfd2
58
2022-05-05 17:12:08
1
b442890b76279faf1e9fd1131010b112df3222619ae2541ea46f55cf4977a311
57
2022-05-05 17:05:28
4
016eb9c48a199bb2131ff908b6f311af0e9de34b5991540ad12d1763423e843c
58
2022-05-05 16:56:46
0
0d63298b9aca559a31f423b720ba6431b9b000d0bc48a3858e15b85afa73e573
58
2022-05-05 12:41:31
4
da72915615a965c07ed827d9d276d45a7a88490c9fe13c71b7c25bdaf34b0c85
58
2022-05-03 15:57:41
5
a53c8e8a5f6c5b65613724b38b47daad06bfd5459e0cb0c78b280c2080838097
59
2022-05-02 09:23:08
17
7b719a65fcf59e41a68b81477acae8d58962609261aeb17d5cc8edb8995c0de9
59
2022-05-02 09:22:00
16
da4c347579046c10600ea3e0652a54b54f9204220ffb9b459dba2ffe9203fd9f
59
2022-05-02 09:21:58
5
68fdd4d17b33ec958752b80ca5f3490ff3bf43851d9459ef3dbe2d6b026f172c
59
2022-05-02 09:21:58
17
33b836865ecd5827f270429d28519f13879b3062d7843d6a3bc9c156b9c6bb68
59
2022-05-02 09:21:58
6
5ac13b404e2c7c23757a317bee419a94560725e7a2cbc1f67d12dc02ca903843
59
2022-05-02 09:21:55
16
26aed07a7cc543237b68e0bcc987e6a7fa6eff303ed7e04bc1908955a6a0b3a7
59
2022-05-02 09:21:54
34
024a91a7bb3d9879087802d04a9e2e209fa8ea452269f2330db75c901af61daa
63
2022-05-02 06:50:53
2
6de3701e27425cb3e0bb753fb3a5b1e48621155b3435d8e975186e0a6fb5f128
57
2022-05-02 05:19:15
4
07bb2f89c488c41d1cc78c702d342b6ca922544f1b004d5c641b23f58ab377d9
57
2022-05-01 15:31:59
4
52078b7ce4bc40c39689fe1a186ed4c084ffd42cc7152434cc9fe69f208e9884
57
2022-04-29 14:58:17
3
1fccae827d85afedd4358f94e27501156e846d1281789e19450db963be933218
58
2022-04-29 14:08:19
3
793913cf754f589382b7f030efaf40dd6dab3589da0fa6289222fa2402e0eeaf
56
2022-04-27 12:35:37
27
39d49f6babe1a9b5c6801e01fba14ffcea76c65ee766a2f79d36b16626d0f76b
67
2022-04-27 12:34:28
6
6c247bcea5ac235acce6f7189632f098d21e4fdc38d3e7be66f3e00cbffb717d
56
2022-04-27 12:29:03

Rule Matches per Month (last 24 months)