MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 074e4aaa00517709931df3e7ae2ffca63b5a5d9dbb73549028305f54c4b622df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	074e4aaa00517709931df3e7ae2ffca63b5a5d9dbb73549028305f54c4b622df
SHA3-384 hash:	91fc1a6df9d5668a7be40cc338c8afe9451dfe957d90dfbf2a536bba71f8d17bdfb0ae6a7383085ae79a02a2897a1b0d
SHA1 hash:	42172325509df444e0ef40557d3231a8501fdc1d
MD5 hash:	004bf26c96d7d34bae07712e13d41119
humanhash:	massachusetts-failed-pasta-nineteen
File name:	RFQ CZA038694-00-2.js
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	814'064 bytes
First seen:	2026-08-26 07:53:06 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:eYSCNiQY9bevxpT7bT6dQimayy+ieo1mMUWtmnXdKlsXmsveSkau1ZUtOoBTGPXp:G
TLSH	T1D4051576C2FD2F69C4275A58CDB93C0C9CF054A10B4EF87AAD3764C9D47CBDA66A0160
Magika	javascript
Reporter	abuse_ch
Tags:	js PureLogsStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

165

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Rogue.0hr.20260826-0933.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

downloader encrypted evasive obfuscated repaired

Link:

https://www.filescan.io/uploads/6a8e9b6bdb4311ee2f7c2e91/reports/fea419d2-b0bb-4845-a8da-002823199efd/overview

Hybrid Analysis JS/Downldr.YD

Verdict:

Suspicious

Labled as:

JS/Downldr.YD

Link:

https://www.hybrid-analysis.com/sample/074e4aaa00517709931df3e7ae2ffca63b5a5d9dbb73549028305f54c4b622df

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2026-08-26T04:02:00Z UTC

Last seen:

2026-08-27T05:21:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/074e4aaa00517709931df3e7ae2ffca63b5a5d9dbb73549028305f54c4b622df/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1963891

Signature

Benign windows process drops PE files

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

19%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/074e4aaa00517709931df3e7ae2ffca63b5a5d9dbb73549028305f54c4b622df

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/074e4aaa00517709931df3e7ae2ffca63b5a5d9dbb73549028305f54c4b622df/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=a5hevkqakf3qtey56pt24l74uy5vuxm5xnzvjebigbpvjrfwelpq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260826-jq7p6aam2s/

Behaviour

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Checks computer location settings

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.50

Link:

https://yomi.yoroi.company/submissions/074e4aaa00517709931df3e7ae2ffca63b5a5d9dbb73549028305f54c4b622df