MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b2a6e800df9303ce53a9480c7eeeeabd17a16bed29e6a45bdb782cb627c0bd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6b2a6e800df9303ce53a9480c7eeeeabd17a16bed29e6a45bdb782cb627c0bd6
SHA3-384 hash:	23629c7499da0b027a69f96c2f683b96b088f15aa2fa0e7b6979323665d778cdcfef8a45e18f999efd56d7785d12cf33
SHA1 hash:	497c7b851892d4b1c07799ba10122915186686c6
MD5 hash:	1c186f057ca3d6a7ef7168bf2a355cc8
humanhash:	grey-oregon-hydrogen-magnesium
File name:	FedEx Document.pdf.js
Download:	download sample
File size:	4'863'458 bytes
First seen:	2026-09-30 08:20:03 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:4BYRvD7n3Vj5ABuBHCwD1RJ2ApGaIefZOY:4BYRvD7n3Vj5ABuBHCwD1RJ2ApGaIeF
TLSH	T175365FC749CB7849CBAB9066D1A2784D17CC6A19CF4C1A121FCE3E356E6C633505B3BA
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	vba
Reporter	abuse_ch
Tags:	FedEx js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

161

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Clean

Verdict:

Clean

Score:

N/A%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ace56852e5d8a93d8150026

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

masquerade repaired

Link:

https://www.filescan.io/uploads/6abcc64d25669a719c0c08bd/reports/d1244f57-62c4-41da-90b0-f2cce95431ef/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6b2a6e800df9303ce53a9480c7eeeeabd17a16bed29e6a45bdb782cb627c0bd6

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-09-29T02:33:00Z UTC

Last seen:

2026-10-02T05:28:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/6b2a6e800df9303ce53a9480c7eeeeabd17a16bed29e6a45bdb782cb627c0bd6/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1979917

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code references suspicious native API functions

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Creates processes via WMI

Detected large data written to user environment variables, potentially indicating payload staging for fileless execution

Drops script or batch files to the startup folder

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Powershell connects to network

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Drops script at startup location

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious Environment Variable Has Been Registered

Sigma detected: Suspicious Parent Double Extension File Execution

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses an obfuscated file name to hide its real file extension (double extension)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6b2a6e800df9303ce53a9480c7eeeeabd17a16bed29e6a45bdb782cb627c0bd6

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6b2a6e800df9303ce53a9480c7eeeeabd17a16bed29e6a45bdb782cb627c0bd6/

ReversingLabs TitaniumCloud Script-JS.Trojan.Multiverze

Threat name:

Script-JS.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-29 12:55:47 UTC

File Type:

Binary

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nmvg5aan7eydzzj2ssamp3xovpixufv62kpgurn5w6bmwyt4bpla._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/260930-j8lkmsxz7p/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

Enumerates connected drives

Creates a file in the Startup directory

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/6b2a6e800df9303ce53a9480c7eeeeabd17a16bed29e6a45bdb782cb627c0bd6