MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e63b2f242c63fa9a1e1f49a3227d8a944c225e3bbe04b113d9b40caefc8deb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7e63b2f242c63fa9a1e1f49a3227d8a944c225e3bbe04b113d9b40caefc8deb8
SHA3-384 hash:	d551198cf01bc0b36da0fd4d83ab97dc8102019947787c6b7994c5d01e4211e4e95aeb8f59eae45d51a4f51a95a24be6
SHA1 hash:	6fb0b696eeea15a8ff3825215c360d460a25d0d0
MD5 hash:	3b83083c00e3cb23b4d8bc395a83df2c
humanhash:	freddie-florida-failed-july
File name:	WINDSHIELD PN#_Desc_Qty_&_Condition.js
Download:	download sample
Signature	njrat Alert Create hunting rule
File size:	142'102 bytes
First seen:	2025-05-30 19:06:03 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	1536:+kk8Mm06060606060MZe8nDYvlbr+Gkmi4G0606060606060J:TMm06060606060U0606060606060J
TLSH	T1FBD3901693FE8244E4F78B0EC1AB023053BABC662D3F815D5161E5494EFAF0499A97F3
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	vba
Reporter	Anonymous
Tags:	js NjRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

450

Origin country :

US

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.23127.10537.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=683a02e4acf88f5815e933a2

Tags:

phishing dropper shell sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 evasive powershell

Link:

https://www.filescan.io/uploads/683a01ab171e01f95931e399/reports/c7fa98fa-bd97-4f0d-a9dc-176d47bbcec1/overview

Hybrid Analysis JS/TrojanDownloader.Agent

Verdict:

Suspicious

Labled as:

JS/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/7e63b2f242c63fa9a1e1f49a3227d8a944c225e3bbe04b113d9b40caefc8deb8

Joe Sandbox Njrat

Result

Threat name:

Njrat

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.phis.troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1700920

Signature

Adds a directory exclusion to Windows Defender

AI detected malicious Powershell script

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Creates autostart registry keys with suspicious values (likely registry only malware)

Creates multiple autostart registry keys

Disables zone checking for all users

Encrypted powershell cmdline option found

Hides threads from debuggers

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Modifies the windows firewall

Self deletion via cmd or bat file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Paste sharing url in reverse order

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Uses netsh to modify the Windows network and firewall settings

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Uses threadpools to delay analysis

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Njrat

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Malware

Score:

94%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7e63b2f242c63fa9a1e1f49a3227d8a944c225e3bbe04b113d9b40caefc8deb8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7e63b2f242c63fa9a1e1f49a3227d8a944c225e3bbe04b113d9b40caefc8deb8/

ReversingLabs TitaniumCloud Script.Dropper.Heuristic

Threat name:

Script.Dropper.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-30 18:16:21 UTC

File Type:

Text (JavaScript)

AV detection:

2 of 24 (8.33%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pzr3f4scyy72tipb6sndej6yvfcmejpdxpqewej5tnamv36i324a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

defense_evasion discovery execution persistence

Link:

https://tria.ge/reports/250530-xr7nfagm6v/

Behaviour

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Network Configuration Discovery: Internet Connection Discovery

Drops file in System32 directory

Adds Run key to start application

Hide Artifacts: Hidden Window

Indicator Removal: File Deletion

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7e63b2f242c63fa9a1e1f49a3227d8a944c225e3bbe04b113d9b40caefc8deb8