MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 44fe754a01619e7a354028126a1e339c5995f7ca7a8c7b9fe4975cd966c785e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 9
| SHA256 hash: | 44fe754a01619e7a354028126a1e339c5995f7ca7a8c7b9fe4975cd966c785e0 |
|---|---|
| SHA3-384 hash: | dd7f4891569bf6630a4f67a11769a26789541b2bb9d965d05190909530c57d2099561d7560f840a643a14bbd2391a1aa |
| SHA1 hash: | 5921c5e713649571dff56f9235290d5d3eb05258 |
| MD5 hash: | d9b41ddf12f9f82b6c8317cc134266a0 |
| humanhash: | alabama-mountain-twenty-delta |
| File name: | 44fe754a01619e7a354028126a1e339c5995f7ca7a8c7b9fe4975cd966c785e0 |
| Download: | download sample |
| File size: | 3'556'077 bytes |
| First seen: | 2026-11-01 20:54:26 UTC |
| Last seen: | Never |
| File type: |  js |
| MIME type: | application/javascript |
| ssdeep | 49152:qW6B18fDdPGstGU4RiRtftiZ1lDhG2Ait9TOw8ccYQST10daMChBe7os+2un0:D |
| TLSH | T154F596C81541F03BAACC175B7E7D6ADDE5BB5DA2A0CCA48B8594BC6F6DAC007C068CD4 |
| Magika | javascript |
| Reporter |  Tatamis |
| Tags: | ContagiousInterview DPRK github js |
Tatamis
Contagious Interview (publicly tracked fake job-interview campaign). Observed statically in operator-controlled GitHub repositories, October 2026; nothing executed, no attacker host contacted. payload from operator repository rich-diamond2026/diamond (10/10), git blob a0be2b3c2b7bf300ecbc64ab9e2d4872545e7d76Intelligence
File Origin
# of uploads :
1
# of downloads :
15
Origin country :
ROVendor Threat Intelligence
No detections
Verdict:
Clean
Score:
99.9%
Tags:
n/a
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated repaired
Verdict:
Malicious
File Type:
js
First seen:
2026-11-01T18:54:00Z UTC
Last seen:
2026-11-02T20:43:00Z UTC
Hits:
~10
Result
Threat name:
n/a
Detection:
suspicious
Classification:
n/a
Score:
22 / 100
Signature
Sigma detected: WScript or CScript Dropper
Behaviour
Behavior Graph:
Score:
96%
Verdict:
Malware
File Type:
SCRIPT
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Javascript T1059.007
Gathering data
Threat name:
Win32.Trojan.PolinRider
Status:
Suspicious
First seen:
2026-11-02 00:09:19 UTC
File Type:
Text (JavaScript)
AV detection:
9 of 24 (37.50%)
Threat level:
5/5
Detection(s):
Suspicious file
Malware Family:
polinrider
Malicious:
True
Tags:
javascript
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
js 44fe754a01619e7a354028126a1e339c5995f7ca7a8c7b9fe4975cd966c785e0
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.