Scan report · 29 days agoPublic

www.powershellgallery.com

13.107.246.53AS8075 · US

Submittedhttps://www.powershellgallery.com/packages/Az.Accounts

Landed onhttps://www.powershellgallery.com/packages/Az.Accounts/5.5.3· 1 redirect

page delivers an executable (https://www.powershellg…LoadAuthenticators.ps1)

delivers a script, not an installer ("PostImportScripts%5CLoadAuthenticators.ps1")

Engine tags

Verdict

2 of 8 enginesSuspiciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 9.2 s · 14 requests

01 · Visitor openswww.powershellgallery.com/packages/Az.Accounts

02 · Redirected · 1 hopSame host, another address/packages/Az.Accounts/5.5.3

03 · Page shown

PowerShell Gallery | Az.Accounts 5.5.3styled as Microsoft · low

04 · File delivered · suspiciousPostImportScripts_LoadAuthenticators.ps1www.powershellgallery.comHanded over by the page, not served at the scanned address.

05 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Be careful — warning signs found

Automated

Its page title claims to be Microsoft, which this address is not associated with. This site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.

What to do

Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.

"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.

Findings

Strongest first

Suspicious fileSuspicious content in the downloaded file

PostImportScripts_LoadAuthenticators.ps1

We analysed the file this page delivered — it is Suspicious.

Success

SHA-256 113a57d0a31a85fb74583a7936fbc74941ab03625775d2f51505e3c4028aa44e

SupportingPage delivers an executable under a document pretext

https://www.powershellgallery.com/packages/Az.Accounts/5.5.3/Content/PostImportScripts%5CLoadAuthenticators.ps1 · delivers a script, not an installer ("PostImportScripts%5CLoadAuthenticators.ps1")

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

InfoBrand impersonation detected

Microsoft · low

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

InfoCross-domain scripts injected at runtime

1 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Delivered fileCleanPostImportScripts_LoadAuthenticators.ps1

SHA-256113a57d0a31a85fb74583a7936fbc74941ab03625775d2f51505e3c4028aa44e

Fromhxxps://www[.]powershellgallery[.]com/packages/Az[.]Accounts/5[.]5[.]3/Content/PostImportScripts%5CLoadAuthenticators[.]ps1

Infrastructure

IP: 13.107.246.53MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US · AS8075US
TLS: CN=GeoTrust TLS RSA CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US · expires Dec 13, 2026
Redirects: 1 hop · /packages/Az.Accounts → /packages/Az.Accounts/5.5.3

WHOIS

Registrar: Nom-iq Ltd. dba COM LAUDE
Created: Oct 15, 2014
Expires: Oct 15, 2026
Nameservers: ns1-08.azure-dns.comns2-08.azure-dns.netns3-08.azure-dns.orgns4-08.azure-dns.info

6 malicious10 suspicious

Hashes & fingerprints

Page Hash50831c924dc34a75b55a4722bb895ce916ec42292a8cc1f8e3fea9e3db229962 Favicon Hash057e897a83922d17356272214219a312fc399458a616d517876dc046ffa0c0de DOM Hashd5d6b51df051614ae29ce51d781aa39beb61aa7abc7b9ee23f6abeeaa28ce3eb Screenshot pHash801f83c3fc71e8e3 JARM2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06b JA4X7d5dbb3783b4_7022c563de38_2cdf432ec278 Cert Thumbprint9C17ABE8112F40411FA49083ED403634CA81F10A Cert IssuerCN=GeoTrust TLS RSA CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US

Page capture

Live

Title “PowerShell Gallery | Az.Accounts 5.5.3” · brand shown: Microsoft (low)

Visit Site

Engines

8 · time to verdict