MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fbf34544585fd88106ff326329502bc0d2d65f7d380c7cc810d076428e8a7c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5fbf34544585fd88106ff326329502bc0d2d65f7d380c7cc810d076428e8a7c5
SHA3-384 hash:	f491b0180eb0d5709cd438e718e102e5ce57c75769b67d869074796918b4330b775988e102768cccf23ab250370bb4bb
SHA1 hash:	99f11783838f5fae87f43e1e6394464c99076134
MD5 hash:	e8438d34874bf5207016c01472087b4f
humanhash:	double-princess-vegan-fourteen
File name:	RFQ-RFP-000000182718 PCDSB 160626- 1159.js
Download:	download sample
Signature	PhantomStealer Alert Create hunting rule
File size:	30'441 bytes
First seen:	2026-06-15 20:37:03 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:0fyVeG3wdBKimZRc5pHhpQbxQ9610l7CFJSc:QnA1ZLxQ96y7cUc
TLSH	T18BD270C937D5B4644323BC3B7E6BB2E6E16D8CC8BA5C9444FBA5708AFC24708C925758
Magika	javascript
Reporter	abuse_ch
Tags:	js PhantomStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

155

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.32424.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a3062c334eaf30d8ce67910

Tags:

vmdetect keylog shell word

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

evasive obfuscated repaired

Link:

https://www.filescan.io/uploads/6a306295bf16337e43c7d9db/reports/2591f060-9e81-42d3-bda2-18d5cfcd9486/overview

Hybrid Analysis SVM:TrojanDownloader/JS.Nemucod

Verdict:

Malicious

Labled as:

SVM:TrojanDownloader/JS.Nemucod

Link:

https://www.hybrid-analysis.com/sample/5fbf34544585fd88106ff326329502bc0d2d65f7d380c7cc810d076428e8a7c5

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-14T23:37:00Z UTC

Last seen:

2026-06-17T16:31:00Z UTC

Hits:

~100

Detections:

Trojan-Downloader.Agent.HTTP.C&C PDM:Trojan.Win32.Generic Trojan-Downloader.JS.SLoad.sb HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.Generic Trojan-PSW.Fareit.HTTP.C&C

Link:

https://opentip.kaspersky.com/5fbf34544585fd88106ff326329502bc0d2d65f7d380c7cc810d076428e8a7c5/results?tab=lookup

Joe Sandbox KeyLogger, Phantom stealer

Result

Threat name:

KeyLogger, Phantom stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

evad.troj.spyw.expl

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1928420

Signature

AI detected malicious Powershell script

Allocates memory in foreign processes

Antivirus detection for URL or domain

Browser instances using unsafe startup parameters

Bypasses PowerShell execution policy

Creates a thread in another existing process (thread injection)

Found malware configuration

Injects a PE file into a foreign processes

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Monitors registry run keys for changes

Multi AV Scanner detection for submitted file

Potential obfuscated javascript found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected Costura Assembly Loader

Yara detected Generic JS Downloader

Yara detected Keylogger Generic

Yara detected Phantom stealer

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5fbf34544585fd88106ff326329502bc0d2d65f7d380c7cc810d076428e8a7c5

Malva.RE

Gathering data

CERT.PL MWDB phantomstealer

Detection:

phantomstealer

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/5fbf34544585fd88106ff326329502bc0d2d65f7d380c7cc810d076428e8a7c5/

Neiki Family.PHANTOM

Verdict:

Malicious

Threat:

Family.PHANTOM

Link:

https://tip.neiki.dev/file/5fbf34544585fd88106ff326329502bc0d2d65f7d380c7cc810d076428e8a7c5

ReversingLabs TitaniumCloud Script.Trojan.Heuristic

Threat name:

Script.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-15 04:26:20 UTC

File Type:

Text (JavaScript)

AV detection:

8 of 36 (22.22%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=l67tivcfqx6yqedp6mtdfficxqgs2zpx2oamptebbudwikhiu7cq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/260615-zp22aagw5m/

Behaviour

Command and Scripting Interpreter: JavaScript

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5fbf34544585fd88106ff326329502bc0d2d65f7d380c7cc810d076428e8a7c5