MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9dd17f480319c584f8dcd48ed79548572eab9b89f717a37afea9ffd7166aa87b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9dd17f480319c584f8dcd48ed79548572eab9b89f717a37afea9ffd7166aa87b
SHA3-384 hash:	b07e07e95746e8d4889be20c7bfa169ef50481036b101d9d592e73b873745dace39d1a816b67c52adc737711c04883d2
SHA1 hash:	c7eb90f614b5a39596489f07bdf4224e6bb9e69a
MD5 hash:	f5ef5dd8262ed14357861ba4eaf91303
humanhash:	cardinal-cat-pennsylvania-spaghetti
File name:	NEW PO 94120875.js
Download:	download sample
File size:	827'592 bytes
First seen:	2026-06-15 04:25:40 UTC
Last seen:	2026-06-15 13:05:07 UTC
File type:	js
MIME type:	text/plain
ssdeep	3072:x27KM35wZoc3nA9KLY7dKphfhSvWbvkFos/c4oguHziBuzOVCsm2RrH9kIhHbVSY:Y6aF
Threatray	105 similar samples on MalwareBazaar
TLSH	T14905083CCC64412FE2B3D619C89A495FF882161B222CE90B54D73B9BAF33946779725C
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	javascript
Reporter	threatcat_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

163

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.14982257.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a2f7ef1a15110463ee5ea18

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6a2f7eefbf16337e43c6a01c/reports/b759bf45-adf4-46ad-b394-f6ff29ab3929/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/9dd17f480319c584f8dcd48ed79548572eab9b89f717a37afea9ffd7166aa87b

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-14T20:34:00Z UTC

Last seen:

2026-06-17T01:46:00Z UTC

Hits:

~1000

Detections:

HEUR:Trojan-Downloader.Script.Generic HEUR:Trojan.Script.Generic PDM:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/9dd17f480319c584f8dcd48ed79548572eab9b89f717a37afea9ffd7166aa87b/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1927800

Signature

.NET source code contains potential unpacker

Creates a thread in another existing process (thread injection)

Creates an undocumented autostart registry key

Injects a PE file into a foreign processes

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

58%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/9dd17f480319c584f8dcd48ed79548572eab9b89f717a37afea9ffd7166aa87b

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9dd17f480319c584f8dcd48ed79548572eab9b89f717a37afea9ffd7166aa87b/

Neiki Trojan.Script

Verdict:

Malicious

Threat:

Trojan.Script

Link:

https://tip.neiki.dev/file/9dd17f480319c584f8dcd48ed79548572eab9b89f717a37afea9ffd7166aa87b

ReversingLabs TitaniumCloud Win32.Trojan.Kepavll

Threat name:

Win32.Trojan.Kepavll

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-14 23:35:57 UTC

File Type:

Text (JavaScript)

AV detection:

13 of 38 (34.21%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=txix6saddhcyj6g42shnpfkik4xkxg4j64l2g6x6vh75oftkvb5q._file

Threatray purecrypter

Verdict:

malicious

Label(s):

purecrypter

Alert

Create hunting rule

Similar samples:

12d51bb5ed6b4db145af16f70b1f498c5757c7d2420bd25f7313f4cb092b0419

3d21d84009b854c9ce26541075b37186418355b1a182b1bd59e432e3b1ba2e5b

580d4b2e65dee44be9ebb0eb5ad85346e807b44ccfd61468ece572cefca804ff

a5903b21a481d11fd8ac07ba5ec097c300f40e247906a0ce2f05f6edccb7630d

b586fa5f52db4174903bbf53eaeb0537b4e7ee9b9f2f42c514536b07f471c754

c73ce00558fd70ab673cdd385ed5b4c30a2a07227ec2035c0657a9aa3ba14741

d6e6cb2c61d3f22b05b49a864283c277f5c852565ec07e70c5f408053d1200ee

error

f9aa29d9b2ba2551de3331bfd681b5a71af3c5d7f32badc68e5f8b96a5631841

+ 95 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260615-e2plhagy8s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Checks computer location settings

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9dd17f480319c584f8dcd48ed79548572eab9b89f717a37afea9ffd7166aa87b