MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12821dc7fd6a37f6ef3246490071740d15c46a524e9ce0691d2a50c08321b5e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	12821dc7fd6a37f6ef3246490071740d15c46a524e9ce0691d2a50c08321b5e9
SHA3-384 hash:	2499d58b95169505e1fc7be773fb5eca3b677b1773cfa60272800e76cc483b8726402b5c24293a04915aaebf7e314f2c
SHA1 hash:	3753f779757e5e2fdf621670aef2eef8688bb64b
MD5 hash:	7c7ce5269268ad048418b662ada3b03a
humanhash:	burger-ten-potato-happy
File name:	DHL Shipment 6883042880.JS
Download:	download sample
File size:	3'693'881 bytes
First seen:	2026-07-24 12:06:25 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:UgYI17IBNSbgboSnuw4aKDzzdgQTgP1ofDy/Vd/:UgB7IDGjaKnzdbkGfedJ
TLSH	T1A6062A42A72C90B1526FD33CE1BAAE78440D600321DDDF1C34AD6628F565E67A79CAF3
Magika	javascript
Reporter	James_inthe_box
Tags:	exe js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

97

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug downloader dropper evasive masquerade obfuscated obfuscated packed repaired xloader

Link:

https://www.filescan.io/uploads/6a63554a142c5a0b045619c0/reports/387de3eb-32ce-4a9b-845b-46b2e5e1374a/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/12821dc7fd6a37f6ef3246490071740d15c46a524e9ce0691d2a50c08321b5e9

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-23T06:44:00Z UTC

Last seen:

2026-07-24T08:47:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/12821dc7fd6a37f6ef3246490071740d15c46a524e9ce0691d2a50c08321b5e9/results?tab=lookup

Nucleon Malprob Malware

Score:

95%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/12821dc7fd6a37f6ef3246490071740d15c46a524e9ce0691d2a50c08321b5e9

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/12821dc7fd6a37f6ef3246490071740d15c46a524e9ce0691d2a50c08321b5e9/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-23 09:56:07 UTC

File Type:

Text (JavaScript)

AV detection:

8 of 36 (22.22%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ckbb3r75ni37n3zsizeqa4lubuk4i2ssj2ooa2i5fjimbazbwxuq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery execution persistence

Link:

https://tria.ge/reports/260724-n92epsdp5x/

Behaviour

Modifies registry class

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Checks computer location settings

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Formbook

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/12821dc7fd6a37f6ef3246490071740d15c46a524e9ce0691d2a50c08321b5e9