MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 911f7e874a76c3d15065174151f10083cc9497e2ac0ba23950a2ae23c7a7f2d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	911f7e874a76c3d15065174151f10083cc9497e2ac0ba23950a2ae23c7a7f2d5
SHA3-384 hash:	6b1d6fe6bb11f3797373106625b79fa0b291c010d7723a00b9bb1e4a58697f5a909caba21d960202f274cbf54845979d
SHA1 hash:	539972691e0509c20c13a46096256494dd6b4854
MD5 hash:	18b628a57fc8129c14de74cbe7a89f7c
humanhash:	happy-equal-bakerloo-east
File name:	NEW PO 94187500.js
Download:	download sample
File size:	877'510 bytes
First seen:	2026-06-15 20:24:41 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:3+pf6fcEvEfa5cBSD+PwQ1GXcTEwe7yB0l1+xVeS/MvEpeA2YRTywu9/dFRphVen:zDvEfahI9
Threatray	107 similar samples on MalwareBazaar
TLSH	T12B15E83DC994012DF576E618C469084FE8933A4B513CD90B60CA2B5F6FB3986BBD236D
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	abuse_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

133

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Obfus-2662.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a305fd134eaf30d8ce675ea

Tags:

obfuscate stration shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

conhost powershell repaired

Link:

https://www.filescan.io/uploads/6a305fcd3d2a0c6df8ec4819/reports/4dc0a5f6-d85f-4c54-9fe5-0ee90b0ef508/overview

Hybrid Analysis JS/Agent.EJG1

Verdict:

Suspicious

Labled as:

JS/Agent.EJG1

Link:

https://www.hybrid-analysis.com/sample/911f7e874a76c3d15065174151f10083cc9497e2ac0ba23950a2ae23c7a7f2d5

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-15T07:02:00Z UTC

Last seen:

2026-06-17T13:54:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/911f7e874a76c3d15065174151f10083cc9497e2ac0ba23950a2ae23c7a7f2d5/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1928408

Signature

.NET source code contains potential unpacker

Creates a thread in another existing process (thread injection)

Creates an undocumented autostart registry key

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

JScript performs obfuscated calls to suspicious functions

Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

15%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/911f7e874a76c3d15065174151f10083cc9497e2ac0ba23950a2ae23c7a7f2d5

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/911f7e874a76c3d15065174151f10083cc9497e2ac0ba23950a2ae23c7a7f2d5/

ReversingLabs TitaniumCloud Win32.Trojan.Ravartar

Threat name:

Win32.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-15 10:01:58 UTC

File Type:

Text (JavaScript)

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sepx5b2ko3b5cudfc5avd4iaqpgjjf7cvqf2eokqukxchr5h6lkq._file

Threatray purecrypter

Verdict:

malicious

Label(s):

purecrypter

Alert

Create hunting rule

Similar samples:

12d51bb5ed6b4db145af16f70b1f498c5757c7d2420bd25f7313f4cb092b0419

3d21d84009b854c9ce26541075b37186418355b1a182b1bd59e432e3b1ba2e5b

580d4b2e65dee44be9ebb0eb5ad85346e807b44ccfd61468ece572cefca804ff

5f7d6372e9cb0e520e338da6d6abffb384c28c356602272c1c9eda112fc388e4

9dd17f480319c584f8dcd48ed79548572eab9b89f717a37afea9ffd7166aa87b

a5903b21a481d11fd8ac07ba5ec097c300f40e247906a0ce2f05f6edccb7630d

b586fa5f52db4174903bbf53eaeb0537b4e7ee9b9f2f42c514536b07f471c754

c73ce00558fd70ab673cdd385ed5b4c30a2a07227ec2035c0657a9aa3ba14741

error

f9aa29d9b2ba2551de3331bfd681b5a71af3c5d7f32badc68e5f8b96a5631841

+ 97 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260615-zcq39agw2k/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Checks computer location settings

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/911f7e874a76c3d15065174151f10083cc9497e2ac0ba23950a2ae23c7a7f2d5