MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7df6cef7ab9aae2ea08f2f872f6456b5d51d896ddda907a238cd6668ccdc4bb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7df6cef7ab9aae2ea08f2f872f6456b5d51d896ddda907a238cd6668ccdc4bb7
SHA3-384 hash:	8f438f95a1b95a0e246ecbd1b19745c91e1f47c219a99cc75292b7fa07a352ace1c2bee59de806c077214ec67616ed1c
SHA1 hash:	7f63db03c90913b90c6972fabd77c9862cba917f
MD5 hash:	df43394b926e609e6ad020b157b151a1
humanhash:	alaska-dakota-yellow-blossom
File name:	7df6cef7ab9aae2ea08f2f872f6456b5d51d896ddda907a238cd6668ccdc4bb7.js
Download:	download sample
File size:	8'942 bytes
First seen:	2026-04-01 11:08:23 UTC
Last seen:	Never
File type:	js
MIME type:	application/javascript
ssdeep	192:bmwBGtNAZRWNEbTIZC6/FJrenalqlB2SOyys72:bmaZwexarenOQK1d
TLSH	T19702A53616FA123139A6CAAD2A0F90117A66F403321CD544B7DDB3889FCE554E563BFC
TrID	70.0% (.) Unix-like shebang (var.1) (gen) (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	javascript
Reporter	JAMESWT_WT
Tags:	js teampcp

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

2

Origin country :

IT

Vendor Threat Intelligence

ACCE

Gathering data

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69cd23996363ca5d27f095e0

Tags:

virus

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/69cd239058ab754d33bbf2af/reports/4e5260b0-a4b2-4cf7-82cb-662218f5b149/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/7df6cef7ab9aae2ea08f2f872f6456b5d51d896ddda907a238cd6668ccdc4bb7

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-03-27T06:51:00Z UTC

Last seen:

2026-03-27T07:09:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/7df6cef7ab9aae2ea08f2f872f6456b5d51d896ddda907a238cd6668ccdc4bb7/results?tab=lookup

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/7df6cef7ab9aae2ea08f2f872f6456b5d51d896ddda907a238cd6668ccdc4bb7

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7df6cef7ab9aae2ea08f2f872f6456b5d51d896ddda907a238cd6668ccdc4bb7/

ReversingLabs TitaniumCloud Script-JS.Worm.SupplyChain

Threat name:

Script-JS.Worm.SupplyChain

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-20 20:24:46 UTC

File Type:

Text (JavaScript)

AV detection:

12 of 36 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=px3m555ltkxc5iepf6ds6zcwwxkr3cln3wuqpiryzvtgrtg4jo3q._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  4/10

Tags:

antivm discovery execution linux

Link:

https://tria.ge/reports/260401-q7pz1ac15p/

Behaviour

Command and Scripting Interpreter: JavaScript

Enumerates kernel/hardware configuration

Reads runtime system information

Checks CPU configuration

Reads CPU attributes

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.60

Link:

https://yomi.yoroi.company/submissions/7df6cef7ab9aae2ea08f2f872f6456b5d51d896ddda907a238cd6668ccdc4bb7