MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e49ac29cdf21a3db8a06c0a338a5fde07bf2569b2dae19af36180e9f2355142. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2e49ac29cdf21a3db8a06c0a338a5fde07bf2569b2dae19af36180e9f2355142
SHA3-384 hash:	c8e3ce8a433966688ac8ecc797e11660fc435561c383aef279feeb8888b9f3eb62d9d7f7986ab9e144a41371d7fba95d
SHA1 hash:	8e48d0f29aa494d97e3b47faff4fa5e45ab5053c
MD5 hash:	61af7475b436f4c65ce250e9eac0d0cc
humanhash:	wyoming-fish-uniform-dakota
File name:	doc_B285_May_31.js
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	4'911 bytes
First seen:	2023-05-31 16:32:13 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	48:pAq7YPNc/BmjBCblkVmfq9mfCj5mfy09YFdOddkca0j0KRv3rpRsjFKV34Y2ifov:ip1oBmsJG9XlSfRzpRmFmSNCZV4n
TLSH	T198A1C17B9F0E9ABED265FD041188ED0FC6C4C132261F6D83F60755A678ED81882BB5C8
Reporter	pr0xylife
Tags:	1685526716 BB30 js NetSupport Qakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

322

Origin country :

US

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.17301.12768.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Script.SNH-gen.16363.4493.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

nemucod powercat virus

Link:

https://www.filescan.io/uploads/647776c09f24e991a79dc82b/reports/e92a8653-516d-4c56-85e7-a1392ae61e7f/overview

Hybrid Analysis Trojan.Script

Verdict:

Suspicious

Labled as:

Trojan.Script

Link:

https://www.hybrid-analysis.com/sample/2e49ac29cdf21a3db8a06c0a338a5fde07bf2569b2dae19af36180e9f2355142

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1246297

Signature

Creates processes via WMI

JavaScript source code contains functionality to generate code involving a shell, file or stream

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

JScript performs obfuscated calls to suspicious functions

Sigma detected: Execute DLL with spoofed extension

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2e49ac29cdf21a3db8a06c0a338a5fde07bf2569b2dae19af36180e9f2355142/

ReversingLabs TitaniumCloud Win32.Dropper.Generic

Threat name:

Win32.Dropper.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-05-31 16:33:06 UTC

File Type:

Text (JavaScript)

AV detection:

2 of 37 (5.41%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fze2ykon6ind3ofanqfdhcs73yd36jljwlnodgxtmgaot4rvkfba._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/230531-t2g9rage5w/

Behaviour

Suspicious use of WriteProcessMemory

Blocklisted process makes network request

Process spawned unexpected child process

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2e49ac29cdf2/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.60

Link:

https://yomi.yoroi.company/submissions/2e49ac29cdf21a3db8a06c0a338a5fde07bf2569b2dae19af36180e9f2355142