MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fcffd5b8f6c1c9aee777ccb7fca8d9306d218ca2ae084a43cb3f370f4dca280. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4fcffd5b8f6c1c9aee777ccb7fca8d9306d218ca2ae084a43cb3f370f4dca280
SHA3-384 hash:	4df5629c25bb93af6f4e84c504d0ead23ad474da3c2a99a258cae3a0431f852137265561978858fe04a5478f83daa85b
SHA1 hash:	1b1cf837a791c4a757077501228777eaf48023dd
MD5 hash:	d3602ab018e9bafd4de2b8d024a29f7c
humanhash:	fifteen-maryland-vermont-apart
File name:	d3602ab018e9bafd4de2b8d024a29f7c.js
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	1'113'117 bytes
First seen:	2026-03-18 09:46:11 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:dNDdMc2jrixTQ6LpA1U0eQLmDyDyty92qyXY42BF3YAM6YfsWKfuMlpiZWu4rA+l:dNDdM20
Threatray	1'525 similar samples on MalwareBazaar
TLSH	T118350219F61B0AA0D17F94E2049DBB9BCD5A2119F543203A31E391CEBD279AD12E377C
Magika	javascript
Reporter	abuse_ch
Tags:	js xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

111

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69ba74b993b644ca466b3f01

Tags:

obfuscate autorun xtreme virus

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/69ba747f4678eefbc7ae0a20/reports/1cc6ef76-2452-41f4-bd56-92ca30e67c5a/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4fcffd5b8f6c1c9aee777ccb7fca8d9306d218ca2ae084a43cb3f370f4dca280

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

Link:

https://opentip.kaspersky.com/4fcffd5b8f6c1c9aee777ccb7fca8d9306d218ca2ae084a43cb3f370f4dca280/results?tab=lookup

Joe Sandbox XWorm

Result

Threat name:

XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1885489

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Creates processes via WMI

Drops script or batch files to the startup folder

Found malware configuration

Injects a PE file into a foreign processes

JavaScript source code contains functionality to generate code involving a shell, file or stream

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Queries the IP of a very long domain name

Sample uses string decryption to hide its real strings

Sigma detected: Drops script at startup location

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell download and execute

Yara detected UAC Bypass using CMSTP

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

15%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/4fcffd5b8f6c1c9aee777ccb7fca8d9306d218ca2ae084a43cb3f370f4dca280

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4fcffd5b8f6c1c9aee777ccb7fca8d9306d218ca2ae084a43cb3f370f4dca280/

Neiki Trojan.Script.Startup

Verdict:

Malicious

Threat:

Trojan.Script.Startup

Link:

https://tip.neiki.dev/file/4fcffd5b8f6c1c9aee777ccb7fca8d9306d218ca2ae084a43cb3f370f4dca280

ReversingLabs TitaniumCloud Script-JS.Trojan.ObfPadding

Threat name:

Script-JS.Trojan.ObfPadding

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-16 10:11:50 UTC

File Type:

Text (JavaScript)

AV detection:

5 of 36 (13.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j7h72w4pnqojv3txptfx7sunsmdneggkflqijjb4wpzxb5g4ukaa._file

Threatray xworm

Verdict:

malicious

Label(s):

xworm

Alert

Create hunting rule

Similar samples:

0794dde51a3d0c0c712fa764940be7ff12b83e73ffe33ac9c5d0847fc50d9075

XWorm

0f425d11e80b7cf493fb42d4f4866efb68169d3c5b1a90af93ceef9a82649b5f

XWorm

4fc5db02f555a38fe3a0153e1f7d8261fc545a9ac7a2951a4558f5571b20531d

XWorm

e45fdbb2d13cde33ef20e43a38308dca4bbe4718c01268ae960e3e105494923d

XWorm

error

XWorm

f3da246accb9e31bdb4e51187dada28e4c71a927c56adea2333fb9625b1bf7f5

XWorm

+ 1'515 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/260318-lry6hsfv3w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Drops startup file

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/4fcffd5b8f6c1c9aee777ccb7fca8d9306d218ca2ae084a43cb3f370f4dca280