MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18a32a75629cfd7e3b2c30cd2fb2ce458171db591bdd3fd3750a7d2f92f02bf9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	18a32a75629cfd7e3b2c30cd2fb2ce458171db591bdd3fd3750a7d2f92f02bf9
SHA3-384 hash:	9714054ab63b2bd763b7fe25ed8d51a93cbfe47b4e8f32fd6bc5ab093b9822ee12f7b6b858b1f80f2535f71654dcdf08
SHA1 hash:	901ea6ae751030e8d5021d28bcae872bfcdb27c5
MD5 hash:	24e666163912f40cef43b0188f12eb7e
humanhash:	network-yankee-hamper-nitrogen
File name:	Order_399201.xls.js
Download:	download sample
File size:	556'938 bytes
First seen:	2026-08-18 19:15:41 UTC
Last seen:	2026-08-18 19:15:43 UTC
File type:	js
MIME type:	text/plain
ssdeep	6144:UM35fxkmEJw1yPQyakNi7rjxyAtGu9tkh8z0J4mY:/JfrEJwMfwFJtDBk4mY
TLSH	T1F7C4752DF2A4C23558520962D2F1A1038D3DAEAE1F5F12233EBE56DFD3A6D542D138C6
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	TomU
Tags:	js

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

151

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aes base64 base64 base64 conhost crypto downloader evasive lolbin masquerade obfuscated overlay persistence powershell repaired wscript

Link:

https://www.filescan.io/uploads/6a84afd0889dfee7c6257642/reports/c310608c-c399-4bbb-8fce-27fd354bff11/overview

Hybrid Analysis JS/Agent.VEC trojan

Verdict:

Malicious

Labled as:

JS/Agent.VEC trojan

Link:

https://www.hybrid-analysis.com/sample/18a32a75629cfd7e3b2c30cd2fb2ce458171db591bdd3fd3750a7d2f92f02bf9

Nucleon Malprob Malware

Score:

81%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/18a32a75629cfd7e3b2c30cd2fb2ce458171db591bdd3fd3750a7d2f92f02bf9

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/18a32a75629cfd7e3b2c30cd2fb2ce458171db591bdd3fd3750a7d2f92f02bf9/

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-18 00:44:14 UTC

File Type:

Text (JavaScript)

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dcrsu5lctt6x4ozmgdgs7mwoiwaxdw2zdpot7u3vbj6s7exqfp4q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution persistence

Link:

https://tria.ge/reports/260818-xy46wszydx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: JavaScript

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/18a32a75629cfd7e3b2c30cd2fb2ce458171db591bdd3fd3750a7d2f92f02bf9