MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ffa64ce7b0cdb507e113c96dc0777cb340e6a03c559da332d152142eec604ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6ffa64ce7b0cdb507e113c96dc0777cb340e6a03c559da332d152142eec604ab
SHA3-384 hash:	5482339df97c5d5b978694b57befc16e900744d84f059f392047303a5fb9281e89f20d82c8d90a10bc2c872d50711c13
SHA1 hash:	fe4b339024e183e3e8e007ba386402dbe4f4da24
MD5 hash:	d5461763db53d34a9722f0a5f42ef3e0
humanhash:	seventeen-ohio-chicken-tennis
File name:	output_orjxc385.js
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	470'264 bytes
First seen:	2026-08-13 11:35:23 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:FDQPGObQydcAUR+aPHUSHzD87G2bT+Ky3bAOWZ1MuJvupcZ5yS:F8TOP02x2kAgGv
TLSH	T139A496ADE0A4B32558503320D2D18641033FBC8E3B9E325C6AAE6AFF93AD1D45553DF6
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	abuse_ch
Tags:	js PureLogsStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

115

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aes base64 base64 crypto downloader evasive lolbin obfuscated overlay persistence powershell repaired wscript

Link:

https://www.filescan.io/uploads/6a7dac11ee5cf3bc1eadc1c8/reports/7787a713-b23e-4872-bf1c-6fbefa9f2244/overview

Hybrid Analysis JS/Agent.EVW

Verdict:

Suspicious

Labled as:

JS/Agent.EVW

Link:

https://www.hybrid-analysis.com/sample/6ffa64ce7b0cdb507e113c96dc0777cb340e6a03c559da332d152142eec604ab

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-08-12T05:01:00Z UTC

Last seen:

2026-08-15T08:22:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/6ffa64ce7b0cdb507e113c96dc0777cb340e6a03c559da332d152142eec604ab/results?tab=lookup

Joe Sandbox PureLogs Stealer

Result

Threat name:

PureLogs Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1957438

Signature

.NET source code contains method to dynamically call methods (often used by packers)

AI detected malicious Powershell script

Bypasses PowerShell execution policy

Creates a thread in another existing process (thread injection)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Potential evasive JS / VBS script found (domain check)

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Windows Shell Script Host drops VBS files

Writes to foreign memory regions

Wscript called in batch mode (surpress errors)

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected MSIL Injector

Yara detected PureLogs Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

24%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/6ffa64ce7b0cdb507e113c96dc0777cb340e6a03c559da332d152142eec604ab

Malva.RE

Gathering data

CERT.PL MWDB purelogs

Detection:

purelogs

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/6ffa64ce7b0cdb507e113c96dc0777cb340e6a03c559da332d152142eec604ab/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-12 14:24:51 UTC

File Type:

Text (JavaScript)

AV detection:

6 of 24 (25.00%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n75gjtt3btnva7qrhslnyb3xzm2a42qdyvm5umzncuquf3wgasvq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection discovery execution persistence

Link:

https://tria.ge/reports/260813-nqjqjsyarg/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Time Discovery

Executes a VBScript file via the Windows Script Host.

Accesses Microsoft Outlook profiles

Checks computer location settings

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6ffa64ce7b0cdb507e113c96dc0777cb340e6a03c559da332d152142eec604ab