MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23ac49199d2dd8bd67f71c43afe84526efe5cce2c1fff478b2b0db24a91f8a77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	23ac49199d2dd8bd67f71c43afe84526efe5cce2c1fff478b2b0db24a91f8a77
SHA3-384 hash:	53cd8e6c6c899a0275a22bbd47a1fe240aa0ccbe69be59f05c3e90bc09a6ca61555cd691ed283852893226a0e820c577
SHA1 hash:	8a7b69f08a7baf3067306cd5dc1268f2f4ef7ac6
MD5 hash:	d79ba46991aa32b507a43d1f9e1b5164
humanhash:	artist-venus-music-queen
File name:	Requisition_PO-260000710_2026.js
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	2'151'638 bytes
First seen:	2026-07-11 07:04:21 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	12288:WiMXvQPlvaXXh36dwrMQVL62yBgvNcan5:YtTIan5
Threatray	44 similar samples on MalwareBazaar
TLSH	T1C9A537D4CB56307DB1B64384ED498219A70EB6D413EFA82C31B56EEE577310A1AF932C
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	abuse_ch
Tags:	js PureLogsStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

134

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Obfus-417.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a51eb8f13f68731ed6b8d99

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 conhost downloader encrypted lolbin powershell repaired wscript

Link:

https://www.filescan.io/uploads/6a51eb15386045fc08ce999a/reports/559500b7-c221-4cf3-949a-1e10def69efb/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/23ac49199d2dd8bd67f71c43afe84526efe5cce2c1fff478b2b0db24a91f8a77

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-10T04:29:00Z UTC

Last seen:

2026-07-12T04:31:00Z UTC

Hits:

~100

Detections:

PDM:Trojan.Win32.Generic Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/23ac49199d2dd8bd67f71c43afe84526efe5cce2c1fff478b2b0db24a91f8a77/results?tab=lookup

Joe Sandbox PureLogs Stealer

Result

Threat name:

PureLogs Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1940918

Signature

Creates a thread in another existing process (thread injection)

Creates an undocumented autostart registry key

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Yara detected AntiVM3

Yara detected MSIL Injector

Yara detected PureLogs Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/23ac49199d2dd8bd67f71c43afe84526efe5cce2c1fff478b2b0db24a91f8a77

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/23ac49199d2dd8bd67f71c43afe84526efe5cce2c1fff478b2b0db24a91f8a77/

ReversingLabs TitaniumCloud Win32.Backdoor.OutBreak

Threat name:

Win32.Backdoor.OutBreak

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-07-10 11:12:08 UTC

File Type:

Text (JavaScript)

AV detection:

4 of 36 (11.11%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eowesgm5fxml2z7xdrb272cfe3x6lthcyh77i6fswdnsjki7rj3q._file

Threatray purecrypter

Verdict:

malicious

Label(s):

purecrypter

Alert

Create hunting rule

Similar samples:

15baa89a82c5c6055d80915ccec1c4362950ea9ea3748fe8065b6b81dd105bd5

PureLogsStealer

38d8dbf64062747f22fd847354d4f74282946532899a3def1006004675a55d65

PureLogsStealer

63333c3333e6f055cbe0d4443191db5ebbdfde72a88b66583c0954554d5ec9c9

PureLogsStealer

6d3238042cc5e08d7c73b5f0eb80f2c5aa925c3a9ef3e42bc9a5b5ff5d934220

PureLogsStealer

7daa05906e417d5925666a99773e845506a1527aaa03b9001c3efb8a68315032

PureLogsStealer

945721baa7a41aa42dbe33c8b9f7eb8271cf91b4b17d76803af1193b026094e8

PureLogsStealer

df012b61ba220a13b7da5616a48f5ad422800c7bf6ac5b098343cb04e9c67fff

PureLogsStealer

error

PureLogsStealer

f17cb686d2371074b25d8a992014dbd75a454d06d436324001eac3f9f0ecef5a

PureLogsStealer

+ 34 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection defense_evasion discovery execution persistence

Link:

https://tria.ge/reports/260711-hxl7csfw6x/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Time Discovery

Accesses Microsoft Outlook profiles

Obfuscated Files or Information: Command Obfuscation

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/23ac49199d2dd8bd67f71c43afe84526efe5cce2c1fff478b2b0db24a91f8a77