MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 336e3270061d943676348528cdab8fd5b276a4c0b385f3dfe1d9d180039f77e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	336e3270061d943676348528cdab8fd5b276a4c0b385f3dfe1d9d180039f77e5
SHA3-384 hash:	aca94569b23a8cd81263c8dae425f62a21984d2473b8586afd54e512ec5a5200b2c2dfaf5067a3b1a07be66f17ca3b27
SHA1 hash:	82119e5f17dd522010be129a764bd8e556943d62
MD5 hash:	00ec4cb0321a4216fd8153e939d89edb
humanhash:	oranges-stairway-robert-island
File name:	Document-v15-51-07.js
Download:	download sample
Signature	Latrodectus Alert Create hunting rule
File size:	489 bytes
First seen:	2024-12-03 15:55:00 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	12:jxajRlrd3KnX8XhXsajz/4XDRD8fKUNdvbtW+N6eKxHIao:d6lrd3KXGBs0AXDRoiUjDkQR
TLSH	T120F00709CD53FEF408A9AB8D2C790871CBA00048208082B4F6BBD3281B784084000CEB
Magika	javascript
Reporter	pr0xylife
Tags:	BruteRatel js Latrodectus

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

449

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=674f2ae712e85e185e755d4b

Tags:

malware

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/674f29dbe5f1046769292d0e/reports/a9bdd13c-7966-4636-bd2f-968827067682/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/336e3270061d943676348528cdab8fd5b276a4c0b385f3dfe1d9d180039f77e5

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1567620

Signature

Sample has a suspicious name (potential lure to open the executable)

Sigma detected: WScript or CScript Dropper

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/336e3270061d943676348528cdab8fd5b276a4c0b385f3dfe1d9d180039f77e5

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/336e3270061d943676348528cdab8fd5b276a4c0b385f3dfe1d9d180039f77e5/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gnxde4agdwkdm5ruquum3k4p2wzhnjgawoc7hx7b3hiyaa47o7sq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

execution

Link:

https://tria.ge/reports/241203-tcr3naxmdl/

Behaviour

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/336e3270061d943676348528cdab8fd5b276a4c0b385f3dfe1d9d180039f77e5