MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 399f3bb1832ae6bda9c2aecb890e73bc6ab679d9d69f7663c059b79adea43654. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	399f3bb1832ae6bda9c2aecb890e73bc6ab679d9d69f7663c059b79adea43654
SHA3-384 hash:	dc64885a1810f42775916e6aaa90061ca6225186682fbb2a1ce387291b729c538b9867764991b65aab07d596eea62259
SHA1 hash:	0a1004e4b14da0429c354097cdedcbb4db082b5f
MD5 hash:	ccac10ff44036275af265c63328fe598
humanhash:	thirteen-fish-cardinal-paris
File name:	output_e7m3ct96.js
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	468'586 bytes
First seen:	2026-08-17 06:39:54 UTC
Last seen:	2026-08-17 08:58:54 UTC
File type:	js
MIME type:	text/plain
ssdeep	3072:V6051wkyZgYzPlmad0kUIdw043AwlnGEtn47/OUxzuP4iS7h+Fzmg0aZo1Nx/yW1:kxzeaTwbQw5DCx0sh+F8s2xJL35B/
TLSH	T12DA4951E19402C4AA0659016DE86C26E916FAD5BAF5F0EC651FFC2DC83B1D0E9843FF6
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	autohotkey
Reporter	lowmal3
Tags:	js PureLogsStealer

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

178

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Muldrop.1389.18522.22316.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aes base64 base64 crypto evasive lolbin obfuscated overlay persistence powershell repaired wscript

Link:

https://www.filescan.io/uploads/6a82ace7668a8d8aaae40005/reports/aa0225c0-f312-4fa0-820b-f3754e3e389d/overview

Hybrid Analysis Trojan/JS.Obfuscated.ju

Verdict:

Malicious

Labled as:

Trojan/JS.Obfuscated.ju

Link:

https://www.hybrid-analysis.com/sample/399f3bb1832ae6bda9c2aecb890e73bc6ab679d9d69f7663c059b79adea43654

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-08-17T00:33:00Z UTC

Last seen:

2026-08-17T03:32:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/399f3bb1832ae6bda9c2aecb890e73bc6ab679d9d69f7663c059b79adea43654/results?tab=lookup

Joe Sandbox PureLogs Stealer

Result

Threat name:

PureLogs Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1958828

Signature

AI detected malicious Powershell script

Bypasses PowerShell execution policy

Creates a thread in another existing process (thread injection)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Potential evasive JS / VBS script found (domain check)

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Windows Shell Script Host drops VBS files

Writes to foreign memory regions

Wscript called in batch mode (surpress errors)

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected MSIL Injector

Yara detected PureLogs Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

41%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/399f3bb1832ae6bda9c2aecb890e73bc6ab679d9d69f7663c059b79adea43654

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/399f3bb1832ae6bda9c2aecb890e73bc6ab679d9d69f7663c059b79adea43654/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hgptxmmdfltl3kocv3fysdttxrvlm6oz22pxmy6alg3zvxvegzka._file

Threatray PureCrypter

Verdict:

malicious

Label(s):

PureCrypter

Alert

Create hunting rule

Link:

https://reports.threatray.com/4fa81c05-b923-4235-9eb6-cfdc2f2ef925

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection discovery execution persistence

Link:

https://tria.ge/reports/260817-hfjpxafm9w/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Time Discovery

Executes a VBScript file via the Windows Script Host.

Accesses Microsoft Outlook profiles

Checks computer location settings

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/399f3bb1832ae6bda9c2aecb890e73bc6ab679d9d69f7663c059b79adea43654