MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5
SHA3-384 hash:	b7a8951967b55f5d1ca4527a411407e478e40d5bbb6bad4692893f6cae2a403107c0e0f829e4e0e883d252f5b7128459
SHA1 hash:	14c6786a756caa05ef041943e38fad73efb29040
MD5 hash:	c9d9a541e248df8728df6b82afa78b26
humanhash:	seventeen-mexico-video-robin
File name:	FIYATTEKLIFISTEGI_TF-2610280002-00_28102026IMP-STF-0285-26.js
Download:	download sample
File size:	7'536 bytes
First seen:	2026-11-04 08:32:09 UTC
Last seen:	Never
File type:	js
MIME type:	application/javascript
ssdeep	48:5NdUgzUmTheZYN4Apia73Dem/eXJWQz2MWHZpdHofhMRQrUy2iDtCvRFujJ:/dUgzUAh3+M39/WYPtZfmWqUFQJ
TLSH	T1FFF1ECDD6C8A60689D73733C8B7FA01CFA775A276206C600BD9D93502F7170492A9EED
Magika	javascript
Reporter	ni_fi_701
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

196

Origin country :

AT

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.82045675.58487556.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6aeaedc53970fcef1e4aff02

Tags:

proxy java

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

FileScan.io

Gathering data

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-11-03T07:42:00Z UTC

Last seen:

2026-11-05T05:36:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1997983

Signature

Can execute downloaded PowerShell hidden with execution-policy bypass

Multi AV Scanner detection for submitted file

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5

Malva.RE Malware

Verdict:

Malware

YARA:

2 match(es)

Tags:

DeObfuscated PowerShell T1027 T1059.001

Link:

https://app.malva.re/file/c9d9a541e248df8728df6b82afa78b26

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5/

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-11-03 13:09:07 UTC

File Type:

Text (JavaScript)

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jf7rrdpxmhkcf4hznwiaelfi7lyhqvgxhquz43xw7t772qzaaxkq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261104-kfhhysgw5x/

Behaviour

Command and Scripting Interpreter: JavaScript

Reads the TCP/IP host and domain name from the registry

Badlisted process makes network request

VirusSign affk

Malware Family:

affk

Alert

Create hunting rule

Malicious:

True

Tags:

javascript

Link:

https://intel.virussign.com/intelligence/file/497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/497f188df761d422f0f96d90022ca8faf07854d73c299e6ef6fcfffd432005d5