MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0199f61ac997eec32bd7cc68743db494739d66c75a9154754a68205a1bbc16be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0199f61ac997eec32bd7cc68743db494739d66c75a9154754a68205a1bbc16be
SHA3-384 hash: 99c44e225e8236cd2977cf5589a00562f05553fa13abf4d7a897bab6db72b6f2dfd3329402b17c4f5a414c9105dc6674
SHA1 hash: 0456271bb5ca375a1a76caebca0e928933fc2bd7
MD5 hash: fac8e30092269550fcc468c8d206d482
humanhash: april-delaware-orange-grey
File name:invoice details PDF.JS
Download: download sample
File size:19'814'404 bytes
First seen:2025-06-28 14:41:02 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 1536:R888CeoGGsAoyrcy9yZLx/VkjAwW8gEW7fYRQ4B5YQEbYr/lQtnAShbT59U888+:GfGYnYr/lQtnAS0
TLSH T12117781B7DF59499225429E0AF238DF80E3AE970CCEFAD8DF6D5D20C290C27185C7969
Magika javascript
Reporter abuse_ch
Tags:js

Intelligence

File Origin
# of uploads :
1
# of downloads :
423
Origin country :
SE SE
Vendor Threat Intelligence
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=685fff2e37c343677946a445
Tags:
dropper emotet virus sage
Verdict:
Malicious
Labled as:
Trojan/JS.Obfuscator
Link:
https://www.hybrid-analysis.com/sample/0199f61ac997eec32bd7cc68743db494739d66c75a9154754a68205a1bbc16be
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1724693
Signature
Benign windows process drops PE files
Drops PE files with a suspicious file extension
Multi AV Scanner detection for submitted file
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Sigma detected: WScript or CScript Dropper
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Behaviour
Behavior Graph:
Download SVG
Score:
95%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/0199f61ac997eec32bd7cc68743db494739d66c75a9154754a68205a1bbc16be
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0199f61ac997eec32bd7cc68743db494739d66c75a9154754a68205a1bbc16be/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=agm7mgwjs7xmgk6xzruhipnusrzz2zwhlkivi5kknaqfug54c27a._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/250628-r2knrswwfz/
Behaviour
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/0199f61ac997eec32bd7cc68743db494739d66c75a9154754a68205a1bbc16be

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments