MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 307ded4d2e7b136f7623eb95ef9c599420e2a5ff0a95a4e0999103d874533d76. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 307ded4d2e7b136f7623eb95ef9c599420e2a5ff0a95a4e0999103d874533d76
SHA3-384 hash: 27674db9125f0d05b8eb003341d5ab1285bbe365a24ffcf972ae50b519e19af52740b93963fc87e30018b04c8e5aa50b
SHA1 hash: 30f240c0d9155c489de60de9ca6db756ffb8f2e9
MD5 hash: 6124d4718cd7d5f87cb8d627fd7ac01e
humanhash: shade-muppet-fifteen-salami
File name:ocafa(3).js
Download: download sample
File size:52'678 bytes
First seen:2026-06-29 02:03:27 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 1536:JkVu9PYS0Npyu8n5njBNLzKSqFPm0o6ebhdMfg:kUP18F85LxaebbM4
TLSH T1F533AD34DB4065985AF01C69859107E5B57580AACEF82B7DA3ADD17F2E44B4EC23F0F8
Magika javascript
Reporter BastianHein
Tags:js

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
CL CL
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a41d2aa86bc95245bfa65fe
Tags:
virus shell sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm downloader encrypted fingerprint obfuscated repaired
Link:
https://www.filescan.io/uploads/6a41d2e9cfb67a2ca0c2f01a/reports/96328140-f935-41e8-8926-b591b3565e60/overview
Verdict:
Malicious
Labled as:
GT:JS.Heur2.Backdoor.4
Link:
https://www.hybrid-analysis.com/sample/307ded4d2e7b136f7623eb95ef9c599420e2a5ff0a95a4e0999103d874533d76
Verdict:
Unknown
File Type:
Link:
https://opentip.kaspersky.com/307ded4d2e7b136f7623eb95ef9c599420e2a5ff0a95a4e0999103d874533d76/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/307ded4d2e7b136f7623eb95ef9c599420e2a5ff0a95a4e0999103d874533d76
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/307ded4d2e7b136f7623eb95ef9c599420e2a5ff0a95a4e0999103d874533d76/
Verdict:
Malicious
Threat:
Trojan-Spy.Script.Efimer
Link:
https://tip.neiki.dev/file/307ded4d2e7b136f7623eb95ef9c599420e2a5ff0a95a4e0999103d874533d76
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gb662tjopmjw65rd5ok67hczsqqofjp7bkk2jyezseb5q5cthv3a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
execution
Link:
https://tria.ge/reports/260629-cheabab12k/
Behaviour
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Checks computer location settings
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.95
Link:
https://yomi.yoroi.company/submissions/307ded4d2e7b136f7623eb95ef9c599420e2a5ff0a95a4e0999103d874533d76

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_obfuscated_JS_obfuscatorio
Create hunting rule
Author:@imp0rtp3
Description:Detect JS obfuscation done by the js obfuscator (often malicious)
Reference:https://obfuscator.io

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments