MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5230c4ebf4f03787e6f4b78233ea6a1ccd5bdede1fbd23ba7e21339c01b0d0e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5230c4ebf4f03787e6f4b78233ea6a1ccd5bdede1fbd23ba7e21339c01b0d0e7
SHA3-384 hash:	d1fbd514847a3786b616bd8b35992d8a6038749fbc8c42722ce699045c8b150873f7f43d3ff5bd6c34cd75bd941aaf42
SHA1 hash:	e310a551f718339f79d8b0a74119358d2f6ef51e
MD5 hash:	d6c142afbb5a25e452e0f902d3b43a3b
humanhash:	wolfram-mexico-pasta-lamp
File name:	license.js
Download:	download sample
Signature	Vjw0rm Alert Create hunting rule
File size:	259'262 bytes
First seen:	2025-04-15 19:41:03 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:5S4SJ+lDfex/l5CDbnl94ZPpy9pH7eJzmz:sVJ+lDfex/l5CDbnl94ZPs9p7eJz4
TLSH	T16744CE3C9EE6043E26659D84A2F50CA3D87D7283631F4F8E718A17C9435384FBEA895D
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	unknown
Reporter	smica83
Tags:	js vjw0rm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

513

Origin country :

HU

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ff3997954c9c53de0b6be1

Tags:

autorun spawn

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67feb65589fec6b88b9d6a62/reports/a7c93bcb-e86d-4e2a-9fb0-42c0cfe32145/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/5230c4ebf4f03787e6f4b78233ea6a1ccd5bdede1fbd23ba7e21339c01b0d0e7

Joe Sandbox VjW0rm

Result

Threat name:

VjW0rm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1665818

Signature

C2 URLs / IPs found in malware configuration

Drops script or batch files to the startup folder

Found malware configuration

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Sigma detected: Drops script at startup location

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected VjW0rm

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5230c4ebf4f03787e6f4b78233ea6a1ccd5bdede1fbd23ba7e21339c01b0d0e7

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5230c4ebf4f03787e6f4b78233ea6a1ccd5bdede1fbd23ba7e21339c01b0d0e7/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-04-15 19:41:10 UTC

File Type:

Text (JavaScript)

AV detection:

5 of 38 (13.16%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kiymj27u6a3ypzxuw6bdh2tkdtgvxxw6d66shot6eezzyanq2dtq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution persistence

Link:

https://tria.ge/reports/250415-yd535awwdt/

Behaviour

Modifies registry class

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Adds Run key to start application

Checks computer location settings

Drops startup file

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.64

Link:

https://yomi.yoroi.company/submissions/5230c4ebf4f03787e6f4b78233ea6a1ccd5bdede1fbd23ba7e21339c01b0d0e7