MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa4ac17e5c5df41e24a161e61825ca59c4a75ca03fd8d9addcd60b73f22b1c27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	aa4ac17e5c5df41e24a161e61825ca59c4a75ca03fd8d9addcd60b73f22b1c27
SHA3-384 hash:	385cff1df81c1e5aed0e83dd7c882602e894f4251b5f6cb36007fc290db9608b395e3680985d13377a85a126ea4a5746
SHA1 hash:	0f92d147cdc971be0d562ecf23c02c3762464ca5
MD5 hash:	2ce717127ad4260e683a066676bcec53
humanhash:	purple-paris-aspen-mockingbird
File name:	FedEx AWB-Documents.js
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	337'300 bytes
First seen:	2026-11-06 10:57:46 UTC
Last seen:	2026-11-09 07:43:34 UTC
File type:	js
MIME type:	application/javascript
ssdeep	3072:Oz36omemHsYQBQyDj9CN0HlsI+i50MMtZO4BVfnHNBNnVfpdunOpN2VSEak/w0Qe:clFLNJ3h
TLSH	T18774C200DAFB82A6F6A71527C4AF57814AB227C970705E1A306CB39C1B738B457D6F1E
Magika	txt
Reporter	abuse_ch
Tags:	FedEx js xworm

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

168

Origin country :

AT

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6aedb3060e723c88a40c8ec1

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Using the Windows Management Instrumentation requests

Creating a process from a recently created file

Creating a process with a hidden window

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Creating a file in the %temp% directory

FileScan.io

Gathering data

Hybrid Analysis JS/TrojanDropper.Agent

Verdict:

Malicious

Labled as:

JS/TrojanDropper.Agent

Link:

https://www.hybrid-analysis.com/sample/aa4ac17e5c5df41e24a161e61825ca59c4a75ca03fd8d9addcd60b73f22b1c27

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

Link:

https://opentip.kaspersky.com/aa4ac17e5c5df41e24a161e61825ca59c4a75ca03fd8d9addcd60b73f22b1c27/results?tab=lookup

Joe Sandbox XWorm

Result

Threat name:

XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1999682

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected malicious Powershell script

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Creates processes via WMI

Found malware configuration

Injects a PE file into a foreign processes

Installs a global keyboard hook

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Powershell connects to network

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample has a suspicious name (potential lure to open the executable)

Sample uses string decryption to hide its real strings

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

Javascript JS Emulation Trace Scripting.FileSystemObject T1059.007 T1105 WbemScripting.SWbemLocator WScript.Shell

Link:

https://app.malva.re/file/2ce717127ad4260e683a066676bcec53

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aa4ac17e5c5df41e24a161e61825ca59c4a75ca03fd8d9addcd60b73f22b1c27/

ReversingLabs TitaniumCloud Win32.Trojan.Qwexlafiba

Threat name:

Win32.Trojan.Qwexlafiba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-11-06 10:58:22 UTC

File Type:

Text (JavaScript)

AV detection:

11 of 38 (28.95%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vjfmc7s4lx2b4jfbmhtbqjoklhckoxfah7mntlo42yfxh4rldqtq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261106-m2xk4swy6r/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Reads the TCP/IP host and domain name from the registry

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://kalamataubatuba.com.br/admin/1NUMBER1.png

VirusSign atomy9

Malware Family:

atomy9

Alert

Create hunting rule

Malicious:

True

Tags:

text calls-wmi self-delete obfuscated macro-powershell checks-network-adapters long-sleeps

Link:

https://intel.virussign.com/intelligence/file/aa4ac17e5c5df41e24a161e61825ca59c4a75ca03fd8d9addcd60b73f22b1c27

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/aa4ac17e5c5df41e24a161e61825ca59c4a75ca03fd8d9addcd60b73f22b1c27