MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 444ff869c90f8ad040cc150f72d01a0bac4d7232a97cc078f8e53773b9b50cf2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 444ff869c90f8ad040cc150f72d01a0bac4d7232a97cc078f8e53773b9b50cf2
SHA3-384 hash: 606d53e19f24f6293ca0dd9f08bc15e47ecbdc21fffc4b549283eb33786a6aaafef6c660054516193d844ee226817211
SHA1 hash: 58b322c9783c3415ee8200d034f49196c6dd2eda
MD5 hash: 0c0c2c044aa3f18a457da06281f4bd93
humanhash: apart-charlie-social-papa
File name:Comprobante de pago.js
Download: download sample
File size:1'084'983 bytes
First seen:2026-08-11 12:16:02 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 768:kKePA4KGpIvUiCUpINGpAPUiCA43gmgvUiuN+AI/mPU+UpIFielcKbpI3NiKKbCD:luZ
TLSH T117355E32D7F6A56253A0330EAD2A042EB7AD5CDD528355F7330EF4D07DDAA8112139BA
Magika javascript
Reporter James_inthe_box
Tags:exe js

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 evasive fingerprint obfuscated overlay powershell repaired
Link:
https://www.filescan.io/uploads/6a7b129c161a9ef16e7bfe0f/reports/600a88d1-f24d-497e-949d-db4d8d925a1a/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/444ff869c90f8ad040cc150f72d01a0bac4d7232a97cc078f8e53773b9b50cf2
Verdict:
Malicious
File Type:
js
First seen:
2026-08-10T11:57:00Z UTC
Last seen:
2026-08-13T10:30:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/444ff869c90f8ad040cc150f72d01a0bac4d7232a97cc078f8e53773b9b50cf2/results?tab=lookup
Score:
52%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/444ff869c90f8ad040cc150f72d01a0bac4d7232a97cc078f8e53773b9b50cf2
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/444ff869c90f8ad040cc150f72d01a0bac4d7232a97cc078f8e53773b9b50cf2/
Threat name:
Script-JS.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-10 23:21:39 UTC
File Type:
Binary
AV detection:
6 of 38 (15.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=irh7q2ojb6fnaqgmcuhxfua2bowe24rsvf6ma6hy4u3xhonvbtza._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution
Link:
https://tria.ge/reports/260811-pfn3yssfmb/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Badlisted process makes network request
Process spawned unexpected child process
Malware Config
Dropper Extraction:
https://muddy-sound-e0cd.nodetectonn.workers.dev/PPRvN
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/444ff869c90f8ad040cc150f72d01a0bac4d7232a97cc078f8e53773b9b50cf2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments