MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54a03c4e327e011109213cea90b3b600df2eeee457dae410ec2aff29b76b87b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureHVNC


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54a03c4e327e011109213cea90b3b600df2eeee457dae410ec2aff29b76b87b1
SHA3-384 hash: 03c0264285a36af866f90e5daba63c5bc401b49ce42290ae1b8c928f9099d3327ee28b2121cada1a49e7bd2df64ef498
SHA1 hash: a6b96dfb6adf79a41de2c2ac69b6482dd308bf8a
MD5 hash: 71ab57c6faee638c8947d5c809c5bcad
humanhash: ten-johnny-mango-wyoming
File name:invoice.js
Download: download sample
Signature PureHVNC
Create hunting rule
File size:249'178 bytes
First seen:2026-04-17 14:00:35 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 6144:tbcqjbSs+armDRaQhVB3k5RXT+zD054LPucGZJSqTE+mHvRMFwR:B1OhVB3kx+zDoSNGgQo
Threatray 140 similar samples on MalwareBazaar
TLSH T188342B3EDAE80016E1B3D624FE660413E5677F66263D8C8C22C5128E4BB350D75AEB5F
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika txt
Reporter abuse_ch
Tags:js PureHVNC

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.VBS.Obfuscated-gen.83661796.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69e23db745787c53e53a9bcf
Tags:
n/a
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade repaired
Link:
https://www.filescan.io/uploads/69e23d4e9124ebc087551ba5/reports/beb5d144-7dfc-447a-b7a1-4a77eed18699/overview
Verdict:
Malicious
Labled as:
TR/VBS.Obfuscated
Link:
https://www.hybrid-analysis.com/sample/54a03c4e327e011109213cea90b3b600df2eeee457dae410ec2aff29b76b87b1
Verdict:
Malicious
File Type:
js
First seen:
2026-04-16T21:59:00Z UTC
Last seen:
2026-04-19T00:41:00Z UTC
Hits:
~100
Detections:
PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/54a03c4e327e011109213cea90b3b600df2eeee457dae410ec2aff29b76b87b1/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1900141
Signature
Bypasses PowerShell execution policy
Creates an undocumented autostart registry key
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Sample has a suspicious name (potential lure to open the executable)
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
Score:
82%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/54a03c4e327e011109213cea90b3b600df2eeee457dae410ec2aff29b76b87b1
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/54a03c4e327e011109213cea90b3b600df2eeee457dae410ec2aff29b76b87b1/
Verdict:
Malicious
Threat:
Trojan.Win32
Link:
https://tip.neiki.dev/file/54a03c4e327e011109213cea90b3b600df2eeee457dae410ec2aff29b76b87b1
Threat name:
Script-WScript.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-04-17 05:47:01 UTC
File Type:
Text (JavaScript)
AV detection:
5 of 38 (13.16%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ksqdytrspyarccjbhtvjbm5wadps53xek7noiehmfl7stn3lq6yq._file
Verdict:
malicious
Label(s):
stubrunner
Create hunting rule
Similar samples:
1f09085d69f59c49d58ac2223dfb09a5b3f33d76fee6a77c99e342c1d0d6a4e8
PureHVNC
2eb0e981d79aa8407ccf4d54246cae7c343185e9326ac8b2919c3a55c6f3141d
PureHVNC
54606f52cc55c899e1693a7b2b82c786380e885108dd9c18f8c5170b2d22483f
PureHVNC
7772251f9973041149d84c7bb096014b581be5e81948489c541f16576413e169
PureHVNC
9a0c4f50526f556d0885cdd72bea9316dac5619e070071636da4e199ec922ed0
PureHVNC
e46670e5539dcbb79892bdd666ec63a3992d4c8aa6a33236c7d205b059d6bd93
PureHVNC
e85bf177349f91d23697920f51bc38fa2088d135d206cac70c1111dc79183cc4
PureHVNC
e9344245c5768fd87b34cc93e9ba978c6fc5d02a8a8444048f877dcf9df44e51
PureHVNC
error
PureHVNC
f1711b2ede7039611d0d1b5208dd1322f57817485849943b92528a2f940fa141
PureHVNC
fc5bdf6835859243ea18cce62e91f79ddc938eed2c4d67fe2360a30a2e869d28
PureHVNC
+ 130 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution persistence
Link:
https://tria.ge/reports/260417-rcjp6sbs8s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Registers new Windows logon scripts automatically executed at logon.
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/54a03c4e327e011109213cea90b3b600df2eeee457dae410ec2aff29b76b87b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments