MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05f635babcfecd234ec89193ccf34b4f892e7a07730ed09730443e9abd95a655. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	05f635babcfecd234ec89193ccf34b4f892e7a07730ed09730443e9abd95a655
SHA3-384 hash:	568831153895a9886d7fb53cea62d97c50a0193d1f73891e5093c44066b1466300ed659b5a4a62f7f6bac042672537f8
SHA1 hash:	f2d4134740921a439b4b3cc4ffb75a484a0f1815
MD5 hash:	31805d48c700d38647844a9ee06df760
humanhash:	spaghetti-salami-timing-asparagus
File name:	Purchase Order.JS
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	5'186'958 bytes
First seen:	2026-06-22 15:24:34 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:pXFWi5noCdzy3Z744TNVDeHjaRP4t4NP665bTNIkxOHw4Wz5yC+zgIc8ZwM3vCzp:JMYg44rDidA5IKOXWz5qzk8qQvdP6
TLSH	T1D73629912760A13B7B51C79D6237EF74A44F601318DACF14311EE228B94DC5BA3A8AF7
Magika	javascript
Reporter	abuse_ch
Tags:	js RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

127

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a3954a686bc95245bf8b4de

Tags:

autorun shell sage blic

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive lolbin masquerade obfuscated obfuscated packed persistence repaired schtasks

Link:

https://www.filescan.io/uploads/6a3954391d76d9ec9613fe6c/reports/fe4496bc-ebc9-467e-a32c-d7a33fbd75f2/overview

Hybrid Analysis JS/TrojanDropper.Agent

Verdict:

Suspicious

Labled as:

JS/TrojanDropper.Agent

Link:

https://www.hybrid-analysis.com/sample/05f635babcfecd234ec89193ccf34b4f892e7a07730ed09730443e9abd95a655

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-22T00:03:00Z UTC

Last seen:

2026-06-24T12:08:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/05f635babcfecd234ec89193ccf34b4f892e7a07730ed09730443e9abd95a655/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1931938

Signature

Found potential dummy code loops (likely to delay analysis)

Sigma detected: WScript or CScript Dropper

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

91%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/05f635babcfecd234ec89193ccf34b4f892e7a07730ed09730443e9abd95a655

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/05f635babcfecd234ec89193ccf34b4f892e7a07730ed09730443e9abd95a655/

ReversingLabs TitaniumCloud Script-JS.Trojan.Malgent

Threat name:

Script-JS.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-22 06:18:31 UTC

File Type:

Text (JavaScript)

AV detection:

13 of 38 (34.21%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ax3dlov473gsgtwisgj4z42lj6es46qhomhnbfzqiq7jvpmvuzkq._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader family:remcos botnet:remotehost adware execution loader persistence ransomware rat spyware

Link:

https://tria.ge/reports/260622-sv57kad14t/

Behaviour

Checks SCSI registry key(s)

Modifies Internet Explorer settings

Modifies registry class

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

Boot or Logon Autostart Execution: Active Setup

Detects DonutLoader

Family: DonutLoader

Family: Remcos

Malware Config

C2 Extraction:

www.webdevarrayremco.com:2404
www.webdevarrayremcobackup1.com:2404
www.webdevarrayremcobackup2.com:2404
www.webdevarrayremcobackup3.com:2404

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/05f635babcfecd234ec89193ccf34b4f892e7a07730ed09730443e9abd95a655