MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b445f51cec8ec700beeef46d7146b6093fc6a9334b6bc8deff56b7e9c326ce9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9b445f51cec8ec700beeef46d7146b6093fc6a9334b6bc8deff56b7e9c326ce9
SHA3-384 hash:	cdd70f7e52aeeab5c4f9f3d2fcf11dadd5a58afc0297c33515a98f1798d0ac1f2e95d4083675b8b417d5d7855e0838bb
SHA1 hash:	214c65c27c75cdb8070d2682e4d89b80fac4545f
MD5 hash:	85dce36a548bf75901f912ff499fb582
humanhash:	football-mars-charlie-ceiling
File name:	Order IN3466875KC.js
Download:	download sample
File size:	1'224'530 bytes
First seen:	2026-08-21 08:47:16 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:ez/84WLWqUbGnLv/jcHKY7eMce3IbD3IIbn3HfjYs+TbSLwbs7LiT3Ic3SL3XeMj:guIoqD/KV
TLSH	T1494581FB087E1038F95031ABCE0279072EDA054BB5A3AEF1B2E03A4B7E559CD5558736
Magika	javascript
Reporter	abuse_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

131

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.DownLoader.10768.4006.7881.UNOFFICIAL

Alert

Create hunting rule

Hybrid Analysis JS/TrojanDownloader.Agent

Verdict:

Malicious

Labled as:

JS/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/9b445f51cec8ec700beeef46d7146b6093fc6a9334b6bc8deff56b7e9c326ce9

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1961661

Signature

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Creates processes via WMI

JavaScript source code contains functionality to generate code involving a shell, file or stream

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

Multi AV Scanner detection for submitted file

Obfuscated command line found

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

10%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/9b445f51cec8ec700beeef46d7146b6093fc6a9334b6bc8deff56b7e9c326ce9

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9b445f51cec8ec700beeef46d7146b6093fc6a9334b6bc8deff56b7e9c326ce9/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tncf6uoozdwhac7o55dnofdlmcj7y2utgs3lzdpp6vvx5hbsntuq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/260821-kp1e5az1hw/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

Process spawned unexpected child process

Malware Config

Dropper Extraction:

http://www.2goelectricity.cloud/MSI_PRO.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/9b445f51cec8ec700beeef46d7146b6093fc6a9334b6bc8deff56b7e9c326ce9