MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29ec5bd0ea2d97f069015df58ae2bd9c406be03d566765ece3b377ddebddc712. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	29ec5bd0ea2d97f069015df58ae2bd9c406be03d566765ece3b377ddebddc712
SHA3-384 hash:	ba618d70d07cc3f787bc9a76e16b96adf19a288ba2cde2ce6ccb80be4295c58fef65b389727f8f60a6e362cef499cc00
SHA1 hash:	39496b11ac50e380203ac80b0f8c4830628b2e27
MD5 hash:	9a3a062fc1f78f657045e36476f9572f
humanhash:	video-michigan-foxtrot-bluebird
File name:	ScanFIV-FMA-6349 - 01revCopies09092026.pdf.JS.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	4'754'962 bytes
First seen:	2026-09-13 12:35:05 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:8H1xB7sULOGD/VPGYj0IVas5/fjtsctp8yIufs3Rkv72QFbMhRh9gCicLwdY6ta+:8zNLOG5PGYjrT5/fmctpKufGkv7VehPI
TLSH	T1A126E7416B4495327336EB6C623ACE30D41AA72345C6CB1935BDD2193BACE0B675CFE2
Magika	javascript
Reporter	abuse_ch
Tags:	js RAT RemcosRAT

abuse_ch

RemcosRAT C2:
43.228.157.171:2404

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

147

Origin country :

NL

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

obfuscated repaired

Link:

https://www.filescan.io/uploads/6aa69888a8a7f12b0f1d8734/reports/41f0f538-48b2-4404-8a2e-87ee5761b433/overview

Hybrid Analysis JS/TrojanDropper.ModiLoader

Verdict:

Suspicious

Labled as:

JS/TrojanDropper.ModiLoader

Link:

https://www.hybrid-analysis.com/sample/29ec5bd0ea2d97f069015df58ae2bd9c406be03d566765ece3b377ddebddc712

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-09-13T08:04:00Z UTC

Last seen:

2026-09-13T09:35:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/29ec5bd0ea2d97f069015df58ae2bd9c406be03d566765ece3b377ddebddc712/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1972327

Signature

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: WScript or CScript Dropper

Uses an obfuscated file name to hide its real file extension (double extension)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/29ec5bd0ea2d97f069015df58ae2bd9c406be03d566765ece3b377ddebddc712

Malva.RE

Gathering data

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/29ec5bd0ea2d97f069015df58ae2bd9c406be03d566765ece3b377ddebddc712/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fhwfxuhkfwl7a2iblx2yvyv5tragxyb5kztwl3hdwn353265y4ja._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader family:remcos execution loader rat suricata

Link:

https://tria.ge/reports/260913-psk7tsyxgs/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Detects DonutLoader

Family: DonutLoader

Family: Remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication

Suricata alert: REMCOS RAT Malware Outbound C2 Communication

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/29ec5bd0ea2d97f069015df58ae2bd9c406be03d566765ece3b377ddebddc712