MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 092a448459c06da52ca187b4fddf4bc53614db451a62d0b7dbaacd9c27089aba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	092a448459c06da52ca187b4fddf4bc53614db451a62d0b7dbaacd9c27089aba
SHA3-384 hash:	5273f719b41bfbb2e270217f0f350dec968a5ac31d3ea22b75c7712a9765a329b6d2655b3fd885595919d166cf5c1557
SHA1 hash:	16ce66cc88927812d863fb3f0f17a9d9c4279a9c
MD5 hash:	b5c312c3471b0847e4dff71c13cd4f11
humanhash:	potato-batman-oklahoma-dakota
File name:	orden.js
Download:	download sample
File size:	3'140'815 bytes
First seen:	2026-09-04 16:03:04 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	12288:4XVv2cjLb/GpsUfeW1wwkRm1VSSxQo+xWf4qr52Adboo5d0XkXPbxBhoiNJCrG1U:i
TLSH	T170E5EE197244912ADC63736330BF134BA85BAE3C8337030E7D66DE84D2694EFDDA9166
Magika	javascript
Reporter	abuse_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

161

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cmd conhost conhost.exe evasive lolbin obfuscated powershell powershell.exe repaired

Link:

https://www.filescan.io/uploads/6a9aebc2e909f68a4e228957/reports/9f60b383-d1ed-45b7-9a2f-cafefce62ad1/overview

Hybrid Analysis VBS/Agent.DBI

Verdict:

Suspicious

Labled as:

VBS/Agent.DBI

Link:

https://www.hybrid-analysis.com/sample/092a448459c06da52ca187b4fddf4bc53614db451a62d0b7dbaacd9c27089aba

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-09-04T12:12:00Z UTC

Last seen:

2026-09-04T13:04:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/092a448459c06da52ca187b4fddf4bc53614db451a62d0b7dbaacd9c27089aba/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad.expl

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1968762

Signature

JavaScript file contains suspicious strings

Malicious sample detected (through community Yara rule)

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

8%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/092a448459c06da52ca187b4fddf4bc53614db451a62d0b7dbaacd9c27089aba

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

PowerShell T1059.001

Link:

https://app.malva.re/file/b5c312c3471b0847e4dff71c13cd4f11

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/092a448459c06da52ca187b4fddf4bc53614db451a62d0b7dbaacd9c27089aba/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bevejbczybw2klfbq62p3x2lyu3bjw2fdjrnbn63vlgzyjyitk5a._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

execution

Link:

https://tria.ge/reports/260904-thf8cadn8y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Executes a command shell one-liner

Checks computer location settings

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/092a448459c06da52ca187b4fddf4bc53614db451a62d0b7dbaacd9c27089aba