Malicious PowerShell scripts remain a practical challenge for enterprise security because attackers can combine obfuscation, fileless execution, and legitimate administrative utilities to evade detectors that rely on a single code representation. Existing approaches often model lexical, structural, or semantic information separately, which limits their ability to capture complementary evidence across different abstraction levels. Moreover, converting detected scripts into structured threat intelligence, such as behavioral descriptions, MITRE ATT&CK technique attribution, and attack procedure reconstruction, still requires substantial manual analysis. This paper presents an interpretable framework for malicious PowerShell detection and threat characterization. The detection component integrates script-level static indicators, AST-derived syntactic features, CFG-based execution representations, and contextual embeddings from a fine-tuned language model. These representations are combined through cross-modal interaction and adaptive gated fusion, allowing the classifier to use lexical, syntactic, structural, and semantic evidence jointly. Attribution-based explainability is used to discover important features and generate understandable detection rationales to aid analyst validation. For threat characterization, the framework includes an LLM-assisted semantic reasoning module that generates behavioral descriptions, maps malicious scripts to MITRE ATT&CK techniques, and reconstructs attack procedures. The module follows a generate–verify–validate workflow, where LLM outputs are cross-checked by a second model and reviewed by domain experts. Experiments on three benchmark settings show F1-scores from 0.9893 to 0.9952 with low false positive rates. The semantic reasoning module achieves strong agreement with human references, with BERTScore F1 up to 0.947. These results suggest that the framework can support accurate detection and analyst-oriented threat intelligence generation for malicious PowerShell scripts.