MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71d0f84c366e5de2cbdff9df13579d481e623d4697f1805f701dafac01480ecb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	71d0f84c366e5de2cbdff9df13579d481e623d4697f1805f701dafac01480ecb
SHA3-384 hash:	f65f83c9b39f7b544c2736f4795be24198ac0273ffbb80d9084037fe84e0a1990db31b35465254105e02f1bb80ccf6ec
SHA1 hash:	273d0e3c4e63544b4b2448e4f1324b39feb28f60
MD5 hash:	ca29fc2a4d9928814bde7c7b41a41b46
humanhash:	west-oklahoma-sad-twelve
File name:	ca29fc2a4d9928814bde7c7b41a41b46.js
Download:	download sample
File size:	24'877'746 bytes
First seen:	2026-02-27 17:11:32 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	96:1ooUGWwZxdbNHtnaMQK6xVLAiXOliJ4qzGlNldy1tVPIWGikJReT+FYpBm+Y4mxK:UYRNO
TLSH	T126471224F50CD2C3DB2AA2EEBC881AD28E7C58AB44E43EA7151A4DDAFC8F50D15734D5
Magika	javascript
Reporter	abuse_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

83

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-152.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69a1d05b8fffa866e3b2de7a

Tags:

obfuscate xtreme blic

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 fingerprint obfuscated powershell repaired

Link:

https://www.filescan.io/uploads/69a1d07497feb4afd65fcb30/reports/211b22dc-8848-49fd-bad2-10f4bb391ccf/overview

Hybrid Analysis GT:JS.ObfPadding.1

Verdict:

Malicious

Labled as:

GT:JS.ObfPadding.1

Link:

https://www.hybrid-analysis.com/sample/71d0f84c366e5de2cbdff9df13579d481e623d4697f1805f701dafac01480ecb

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

Detections:

Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/71d0f84c366e5de2cbdff9df13579d481e623d4697f1805f701dafac01480ecb/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1876151

Signature

Creates processes via WMI

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

2%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/71d0f84c366e5de2cbdff9df13579d481e623d4697f1805f701dafac01480ecb

Malva.RE

Gathering data

CERT.PL MWDB

Gathering data

Neiki Trojan.JS.SAgent

Verdict:

Malicious

Threat:

Trojan.JS.SAgent

Link:

https://tip.neiki.dev/file/71d0f84c366e5de2cbdff9df13579d481e623d4697f1805f701dafac01480ecb

ReversingLabs TitaniumCloud Script-JS.Trojan.ObfPadding

Threat name:

Script-JS.Trojan.ObfPadding

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-02-27 12:56:22 UTC

File Type:

Binary

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ohipqtbwnzo6fs677hprgv45japgepkgs7yyax3qdwx2yakib3fq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/260227-vq2ppaav5g/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/71d0f84c366e5de2cbdff9df13579d481e623d4697f1805f701dafac01480ecb