MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 904d60f6e3fa245bde300e8e0227fc98527eae39cf0752e6e4b387fca39ffe87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	904d60f6e3fa245bde300e8e0227fc98527eae39cf0752e6e4b387fca39ffe87
SHA3-384 hash:	207f6db7d4fbb5580b5763c05daaca76d384935407fe1a71f8c954bf43031ee06a68261db1f1478f74a6ddeec0c66138
SHA1 hash:	d0cbee6a96bd2fd721366337fba3515e39a64248
MD5 hash:	b41eb5a3a76dc1ffa0a3470bf1a2cfed
humanhash:	crazy-dakota-sink-jersey
File name:	doc20261023_qiq9000001191.js
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	121'888 bytes
First seen:	2026-10-23 12:01:29 UTC
Last seen:	Never
File type:	js
MIME type:	application/javascript
ssdeep	3072:LGkO0nQwxB1s5QtXF/97tEiVm/Q3Fq6LGWwjw7BH1ZodSEV3zJC9d50CKm8GO0PQ:nbtnU3
TLSH	T1B5C3EF1477E9400CB5B3AB908BEAB5764A6BB6DB7234914D048C2B0E1B736D48CD3F67
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	abuse_ch
Tags:	js xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

170

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfuscated-gen.82779277.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

N/A%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6adb4d135a22ac805bd9cecd

Tags:

n/a

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6adb4ce17393dbeb37086b6a/reports/cb03e2b9-183c-4102-b2fa-6c6822f39cbe/overview

Hybrid Analysis TR/VBS.Obfuscated

Verdict:

Suspicious

Labled as:

TR/VBS.Obfuscated

Link:

https://www.hybrid-analysis.com/sample/904d60f6e3fa245bde300e8e0227fc98527eae39cf0752e6e4b387fca39ffe87

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-10-23T04:21:00Z UTC

Last seen:

2026-10-25T09:59:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/904d60f6e3fa245bde300e8e0227fc98527eae39cf0752e6e4b387fca39ffe87/results?tab=lookup

Joe Sandbox XWorm

Result

Threat name:

XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1990972

Signature

AI detected malicious Powershell script

Antivirus / Scanner detection for submitted sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Creates processes via WMI

Found malware configuration

Injects a PE file into a foreign processes

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Powershell connects to network

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Silenttrinity Stager Msbuild Activity

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

87%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/904d60f6e3fa245bde300e8e0227fc98527eae39cf0752e6e4b387fca39ffe87

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Javascript T1059.007

Link:

https://app.malva.re/file/b41eb5a3a76dc1ffa0a3470bf1a2cfed

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/904d60f6e3fa245bde300e8e0227fc98527eae39cf0752e6e4b387fca39ffe87/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Heuristic

Threat name:

Script-WScript.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-23 07:38:09 UTC

File Type:

Text (JavaScript)

AV detection:

7 of 24 (29.17%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sbgwb5xd7isfxxrqb2haej74tbjh5lrzz4dvfzxewod7zi4772dq._file

Threatray XWorm

Verdict:

malicious

Label(s):

XWorm

Alert

Create hunting rule

Link:

https://reports.threatray.com/67080d29-cabf-4e66-bb09-a7504af9385f

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261023-n67gjsdw5q/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Reads the TCP/IP host and domain name from the registry

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://lingering-cloud-8a93.zinhoooo.workers.dev/bgini

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.