MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8918151f86687bf6dcd6962b05fe94d4a48c400d89cfdee172d8ee70f06c3403. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 9
| SHA256 hash: | 8918151f86687bf6dcd6962b05fe94d4a48c400d89cfdee172d8ee70f06c3403 |
|---|---|
| SHA3-384 hash: | 49eb6223af0437c5d749dfa7bf9b641bb1a8849fa520dd7300a41e11594bff8eeb499c8fdda977ecd52ab3ee0cb89e6b |
| SHA1 hash: | 6dd583daa12f79a828ceff743a387ea2abced289 |
| MD5 hash: | c5e47e4d9c1d944a79014e2b1fa62384 |
| humanhash: | wisconsin-aspen-burger-november |
| File name: | REQ_For_Payment_Invoice__FER9079900530981016230-800119_pdf.js |
| Download: | download sample |
| File size: | 806'008 bytes |
| First seen: | 2026-06-02 15:48:12 UTC |
| Last seen: | 2026-06-08 14:47:58 UTC |
| File type: |  js |
| MIME type: | text/plain |
| ssdeep | 3072:qmzHrRznCviA328QXSw/U62OUiqjNnBe9yYt5sSURwyAlziPZU40GhvueKUrSsWh:Cs/UOUiq2yjw9 |
| Threatray | 60 similar samples on MalwareBazaar |
| TLSH | T12B05393CCC58412FE476C928C69A486FF4D11617622CE94710C73B5FAE73A86B7A326D |
| TrID | 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1) |
| Magika | txt |
| Reporter |  TomU |
| Tags: | js |
Intelligence
File Origin
# of uploads :
3
# of downloads :
160
Origin country :
CHVendor Threat Intelligence
No detections
Verdict:
Clean
Score:
99.9%
Tags:
n/a
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
masquerade obfuscated repaired
Verdict:
Malicious
File Type:
js
First seen:
2026-06-01T02:45:00Z UTC
Last seen:
2026-06-04T14:30:00Z UTC
Hits:
~1000
Detections:
PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic
Score:
67%
Verdict:
Susipicious
File Type:
SCRIPT
Gathering data
Verdict:
Malicious
Threat:
Trojan.Win32
Threat name:
Script-JS.Trojan.Malgent
Status:
Malicious
First seen:
2026-06-01 08:06:43 UTC
File Type:
Text (JavaScript)
AV detection:
9 of 24 (37.50%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
purecrypter
stubrunner
Similar samples:
+ 50 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
collection defense_evasion discovery execution persistence
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Time Discovery
Drops file in Windows directory
Accesses Microsoft Outlook profiles
Hide Artifacts: Hidden Window
Checks computer location settings
Registers new Windows logon scripts automatically executed at logon.
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
js 8918151f86687bf6dcd6962b05fe94d4a48c400d89cfdee172d8ee70f06c3403
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.