MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f2db98a7545d84ebb4d3ba73ebc4874de0dda692c61d56ea14eec2329965bd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4f2db98a7545d84ebb4d3ba73ebc4874de0dda692c61d56ea14eec2329965bd1
SHA3-384 hash:	20cd868c9309c6ba9b411c1dcd3ba187d89ace01d33e833c7ce1cb126d11febbb94a350206d17647588c6ea06c3852bd
SHA1 hash:	52f2fe34586bfa6a782fd871006cc88f52988c1c
MD5 hash:	07fb7877def87538715fddad8139118d
humanhash:	winter-steak-music-beryllium
File name:	10124658.JS
Download:	download sample
File size:	12'596'817 bytes
First seen:	2026-09-09 18:05:46 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:KtlvKF85DrPTvU1s5Nv6mggPnGw8kSt6DA5l8M9tCN3WIhASObpNMGgVf9rllgRr:WZnW5KU43orjMGgVpgRGyf7RsA
TLSH	T153C6E89A230E8470A53E571CD0BA6561C6D93103559ABB1E33FC3308BBB7A2B674CDD6
Magika	txt
Reporter	abuse_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

87

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan-Downloader.JS.Agent.8374.22959.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

obfuscated repaired

Link:

https://www.filescan.io/uploads/6aa1a0585df170d117fe0f8e/reports/b54496a9-cec6-499d-b87c-5f3d8b60cdf1/overview

Hybrid Analysis JS/TrojanDropper.ModiLoader

Verdict:

Malicious

Labled as:

JS/TrojanDropper.ModiLoader

Link:

https://www.hybrid-analysis.com/sample/4f2db98a7545d84ebb4d3ba73ebc4874de0dda692c61d56ea14eec2329965bd1

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-09-08T22:02:00Z UTC

Last seen:

2026-09-10T15:41:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/4f2db98a7545d84ebb4d3ba73ebc4874de0dda692c61d56ea14eec2329965bd1/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1970949

Signature

Found potential dummy code loops (likely to delay analysis)

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4f2db98a7545d84ebb4d3ba73ebc4874de0dda692c61d56ea14eec2329965bd1

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4f2db98a7545d84ebb4d3ba73ebc4874de0dda692c61d56ea14eec2329965bd1/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-09 02:57:45 UTC

File Type:

Text (JavaScript)

AV detection:

7 of 23 (30.43%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j4w3tctvixme5o2nhott5pciotpa3wtjfrq5k3vbj3wcgkmwlpiq._file

Threatray PhantomStealer

Verdict:

malicious

Label(s):

PhantomStealer

Alert

Create hunting rule

Link:

https://reports.threatray.com/0df93346-3c96-4172-81ad-1ebee42eb83e

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

collection discovery execution spyware stealer

Link:

https://tria.ge/reports/260909-wp177shm71/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/4f2db98a7545d84ebb4d3ba73ebc4874de0dda692c61d56ea14eec2329965bd1