MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53e2e2eb22d028a09597cbf411dfad396e05a6bfa6448aae9816f7cf5150b7f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	53e2e2eb22d028a09597cbf411dfad396e05a6bfa6448aae9816f7cf5150b7f9
SHA3-384 hash:	9cf1bd2b5561e76b56c584cc87aca6a28d59d07bbdfda36b1e386519b3002862710bfeab170bfa164b263c013a5c4fa2
SHA1 hash:	77dc31fba83dd448809666ada7f4cab7d2e2b029
MD5 hash:	69fbd460433a9ea51009f40967a68f19
humanhash:	seven-island-purple-wolfram
File name:	PurchaseOrder-37851.js
Download:	download sample
File size:	1'051'993 bytes
First seen:	2026-08-06 03:48:47 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:g81V2VVCN012KIUi6VESCR6U23WIU1SC12tRUVIU2U12xO1CLtR+qSSX2VSCRUWU:3G
TLSH	T1232562A396F22C1C6B3DA3D3FD521E0947BE440512A8CAFE702A58DAF3D4656E09C5F4
Magika	javascript
Reporter	nat
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

153

Origin country :

TH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade repaired xworm

Link:

https://www.filescan.io/uploads/6a7404408c691cd22af488e9/reports/d8bc55c2-ec78-4f10-8302-f75d8802c885/overview

Hybrid Analysis JS/LausivLoader.H trojan

Verdict:

Malicious

Labled as:

JS/LausivLoader.H trojan

Link:

https://www.hybrid-analysis.com/sample/53e2e2eb22d028a09597cbf411dfad396e05a6bfa6448aae9816f7cf5150b7f9

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-08-05T11:49:00Z UTC

Last seen:

2026-08-07T20:39:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/53e2e2eb22d028a09597cbf411dfad396e05a6bfa6448aae9816f7cf5150b7f9/results?tab=lookup

Nucleon Malprob Benign

Score:

15%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/53e2e2eb22d028a09597cbf411dfad396e05a6bfa6448aae9816f7cf5150b7f9

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/53e2e2eb22d028a09597cbf411dfad396e05a6bfa6448aae9816f7cf5150b7f9/

ReversingLabs TitaniumCloud Script-JS.Trojan.Malgent

Threat name:

Script-JS.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-05 15:40:46 UTC

File Type:

Binary

AV detection:

10 of 38 (26.32%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kprof2zc2aukbfmxzp2bdx5nhfxaljv7uzcivluyc3346ukqw74q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution persistence privilege_escalation

Link:

https://tria.ge/reports/260806-edjqcasfjh/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Creates a file in the Startup directory

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.85

Link:

https://yomi.yoroi.company/submissions/53e2e2eb22d028a09597cbf411dfad396e05a6bfa6448aae9816f7cf5150b7f9