MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5cdd04bc74bc8d2c3ff82508009ae2d94adb7ae1619bfc258190d6a242fc45a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	5cdd04bc74bc8d2c3ff82508009ae2d94adb7ae1619bfc258190d6a242fc45a0
SHA3-384 hash:	16a1f27aad53e0863faefeeae06ec72e7e59170b9adf01593736de0f4086c92ac8f093698eb731ccd5c02ee904a60546
SHA1 hash:	f8aa1504dd47ce144b71e86f4890c24b465345fb
MD5 hash:	7451b3a1606a367820736159fb221715
humanhash:	friend-football-cold-emma
File name:	ORDEN DE COMPRA.js
Download:	download sample
File size:	972'454 bytes
First seen:	2026-09-08 20:12:29 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	12288:occjU15DjjjjqHfWZuZO6ND1y/Qmh7pOTB5nHjjE5Qp5DpNzTc6575DQKZCnj+5N:yWIZw4mh70
TLSH	T1B925BC2DBA39B0588DC97526A22967B1D48B4EBF23375BC72C11FF80A542CB6CC61717
Magika	scss
Reporter	threatcat_ch
Tags:	js

Intelligence

File Origin

# of uploads :

# of downloads :

110

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm anti-vm evasive fingerprint lolbin msbuild obfuscated repaired

Link:

https://www.filescan.io/uploads/6aa06c57ff5991b524d9b9a4/reports/4d7fd990-a605-43f6-8eb7-8bb2563b1812/overview

Verdict:

Malicious

Labled as:

GT:JS.Heur2.Backdoor.4

Link:

https://www.hybrid-analysis.com/sample/5cdd04bc74bc8d2c3ff82508009ae2d94adb7ae1619bfc258190d6a242fc45a0

Verdict:

Malicious

File Type:

text

First seen:

2026-09-08T12:22:00Z UTC

Last seen:

2026-09-08T17:07:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/5cdd04bc74bc8d2c3ff82508009ae2d94adb7ae1619bfc258190d6a242fc45a0/results?tab=lookup

Result

Threat name:

MSIL Logger, MassLogger RAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1970337

Signature

Allocates memory in foreign processes

Benign windows process drops PE files

Contains functionality to inject code into remote processes

Found malware configuration

Injects a PE file into a foreign processes

JavaScript file contains suspicious strings

JavaScript source code contains functionality to generate code involving a shell, file or stream

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses process hollowing technique

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Silenttrinity Stager Msbuild Activity

Sigma detected: WScript or CScript Dropper

System process connects to network (likely due to code injection or exploit)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Score:

67%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/5cdd04bc74bc8d2c3ff82508009ae2d94adb7ae1619bfc258190d6a242fc45a0

Verdict:

inconclusive

YARA:

1 match(es)

Link:

https://app.malva.re/file/7451b3a1606a367820736159fb221715

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5cdd04bc74bc8d2c3ff82508009ae2d94adb7ae1619bfc258190d6a242fc45a0/

Threat name:

Script-JS.Backdoor.Generic

Status:

Suspicious

First seen:

2026-09-08 16:37:24 UTC

File Type:

Binary

AV detection:

4 of 36 (11.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ltoqjpduxsgsyp7yeueabgxc3ffnw6xbmgn7yjmbsdlkeqx4iwqa._file

Result

Malware family:

n/a

Score:

8/10

Tags:

execution

Link:

https://tria.ge/reports/260908-yzgyesxgle/

Behaviour

Command and Scripting Interpreter: JavaScript

Badlisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.78

Link:

https://yomi.yoroi.company/submissions/5cdd04bc74bc8d2c3ff82508009ae2d94adb7ae1619bfc258190d6a242fc45a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	SUSP_obfuscated_JS_obfuscatorio Create hunting rule
Author:	@imp0rtp3
Description:	Detect JS obfuscation done by the js obfuscator (often malicious)
Reference:	https://obfuscator.io

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

js 5cdd04bc74bc8d2c3ff82508009ae2d94adb7ae1619bfc258190d6a242fc45a0

(this sample)

Delivery method

Distributed via e-mail attachment

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample