🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9756d35bfaf89fb465ac208aac29706e86bbdbc8db257454b7e05b0be33f0c8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DonutLoader


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9756d35bfaf89fb465ac208aac29706e86bbdbc8db257454b7e05b0be33f0c8d
SHA3-384 hash: 444f74996924b41479de9e78751a77c3bf3391917eab5e8e9458f311771c183f66e2de118f5e8df975474c543e3e636f
SHA1 hash: f094b00d307a639b4e6802f278390dc711f828cc
MD5 hash: 97b4fabbadc4b5656662bce3c5fd3700
humanhash: hydrogen-wisconsin-virginia-harry
File name:PURCHASE ORDER.JS
Download: download sample
Signature DonutLoader
Create hunting rule
File size:3'852'967 bytes
First seen:2026-09-14 12:07:49 UTC
Last seen:2026-09-14 19:13:36 UTC
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 98304:Vq+i39J1zTmPkr+LHu9XWapNDcwpcxWrHDXCm0zQ3uZi6UmtkzB4nDIBZ:0r+LcmIvD7TkzfUUkzB4sBZ
TLSH T1C1066B780DA0D28A56FADE39C90D6ED6CA1D5EAF1C31BE02757CC94D5F2BA083B4E540
Magika javascript
Reporter abuse_ch
Tags:donutloader js

Intelligence

File Origin
# of uploads :
2
# of downloads :
150
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Other.Malware-gen.64934326.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade obfuscated repaired
Link:
https://www.filescan.io/uploads/6aa7e3c156d9ddb66c43f9e6/reports/eff70e01-8aa7-4072-bdf1-b6e0c00ec7df/overview
Verdict:
Malicious
Labled as:
JS/TrojanDropper.ModiLoader
Link:
https://www.hybrid-analysis.com/sample/9756d35bfaf89fb465ac208aac29706e86bbdbc8db257454b7e05b0be33f0c8d
Verdict:
Malicious
File Type:
js
First seen:
2026-09-14T08:10:00Z UTC
Last seen:
2026-09-15T10:09:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/9756d35bfaf89fb465ac208aac29706e86bbdbc8db257454b7e05b0be33f0c8d/results?tab=lookup
Result
Threat name:
DonutLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1972656
Signature
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Sigma detected: WScript or CScript Dropper
Unusual module load detection (module proxying)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses whoami command line tool to query computer and username
Yara detected DonutLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1972656 Sample: PURCHASE ORDER.JS.js Startdate: 14/09/2026 Architecture: WINDOWS Score: 100 53 Malicious sample detected (through community Yara rule) 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 Yara detected DonutLoader 2->57 59 5 other signatures 2->59 9 wscript.exe 2->9         started        11 cmd.exe 1 4 2->11         started        process3 process4 13 HFLEPURNWNQIWACL.PIF 3 9->13         started        17 cmd.exe 1 11->17         started        19 conhost.exe 11->19         started        file5 51 C:\Users\user\...\LCAWIQNWNRUPELFH.url, MS 13->51 dropped 69 Hides threads from debuggers 13->69 71 Unusual module load detection (module proxying) 13->71 21 cmd.exe 1 13->21         started        24 cmd.exe 1 13->24         started        26 cmd.exe 1 13->26         started        32 2 other processes 13->32 28 HFLEPURNWNQIWACL.PIF 1 17->28         started        30 conhost.exe 17->30         started        signatures6 process7 signatures8 61 Uses schtasks.exe or at.exe to add and modify task schedules 21->61 63 Uses whoami command line tool to query computer and username 21->63 34 whoami.exe 1 21->34         started        36 schtasks.exe 1 24->36         started        38 schtasks.exe 1 26->38         started        65 Hides threads from debuggers 28->65 40 cmd.exe 1 28->40         started        43 cmd.exe 1 28->43         started        45 conhost.exe 28->45         started        process9 signatures10 67 Uses whoami command line tool to query computer and username 40->67 47 whoami.exe 1 40->47         started        49 schtasks.exe 1 43->49         started        process11
Score:
95%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/9756d35bfaf89fb465ac208aac29706e86bbdbc8db257454b7e05b0be33f0c8d
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9756d35bfaf89fb465ac208aac29706e86bbdbc8db257454b7e05b0be33f0c8d/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s5lngw727cp3iznmecfkyklqn2dlxw6i3msxivfx4bnqxyz7bsgq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery execution persistence
Link:
https://tria.ge/reports/260914-pa23mazclf/
Behaviour
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Executes a command shell one-liner
Program crash
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks computer location settings
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9756d35bfaf89fb465ac208aac29706e86bbdbc8db257454b7e05b0be33f0c8d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments