MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05913ee2a25cc2de7dc10ed47f6d74b4773d722c021d94b4aa6734243401dfdc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	05913ee2a25cc2de7dc10ed47f6d74b4773d722c021d94b4aa6734243401dfdc
SHA3-384 hash:	ecc1f0b17d61add37bcd1098f63530d1cc8c607410f0ebc1147abd9fb868ea5475bb7b5bc4f2b0ee1d22a096e9f804fa
SHA1 hash:	d2fc789c84fc13b5d7f1a6a5b40640caa80905f4
MD5 hash:	23f7818ecac6ab1e9f081c4da4cc2c9c
humanhash:	oxygen-purple-comet-venus
File name:	Order specification invoice.js
Download:	download sample
File size:	472 bytes
First seen:	2026-09-30 04:20:39 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6:Qq3f2rc4YR2aujtlDeHJUYNQyXOOwOIIlYWeA8rcuXymlYW2g4lqJWKlJDjKmMKa:QqSA2ZtZe6QFflVAFrlV2dnKlK4k
TLSH	T1F3F0E5A265FDD20DB9FB5F24AD326861123B7F81AC38878C01D4181D0CE2600C0B2F73
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	threatcat_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

160

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

downloader masquerade opendir repaired

Link:

https://www.filescan.io/uploads/6abc8e3a5ce6dfbf3e0fb1bc/reports/20bceb47-c8fa-43e1-98b0-033bddfaaf0b/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/05913ee2a25cc2de7dc10ed47f6d74b4773d722c021d94b4aa6734243401dfdc

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-09-29T09:36:00Z UTC

Last seen:

2026-10-01T03:11:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/05913ee2a25cc2de7dc10ed47f6d74b4773d722c021d94b4aa6734243401dfdc/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1979762

Signature

Sample has a suspicious name (potential lure to open the executable)

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

68%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/05913ee2a25cc2de7dc10ed47f6d74b4773d722c021d94b4aa6734243401dfdc

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/05913ee2a25cc2de7dc10ed47f6d74b4773d722c021d94b4aa6734243401dfdc/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-29 07:09:22 UTC

File Type:

Text (JavaScript)

AV detection:

7 of 23 (30.43%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=awit5yvcltbn47obb3kh63luwr3t24rmaiozjnfkm42cinab37oa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260930-eyrlpasv2n/

Behaviour

Script User-Agent

Command and Scripting Interpreter: JavaScript

Reads the TCP/IP host and domain name from the registry

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.08

Link:

https://yomi.yoroi.company/submissions/05913ee2a25cc2de7dc10ed47f6d74b4773d722c021d94b4aa6734243401dfdc