MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac2248d66cadf6597f428cde47f98c1adbb382da0473cceca632dec08ecf3e06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ac2248d66cadf6597f428cde47f98c1adbb382da0473cceca632dec08ecf3e06
SHA3-384 hash:	7d20f898a0fb9523910952537fffe2d37116f290d39d9da67fdeb4a12f40af67f618784e56215272a0d6e4a126495c54
SHA1 hash:	7303311489d63ee8f0335077ecd72cfd0e5ce1b0
MD5 hash:	af6ad00a59545497b8ba0d91ddb0a6af
humanhash:	low-five-island-whiskey
File name:	Urgent Request for Quote-73654323456787652345678-pdf.js
Download:	download sample
File size:	822'448 bytes
First seen:	2026-06-06 19:41:05 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:o/cpbVIXTMKcSgLxlQLXtbsGc/sC02mTbh2H14+HdDJHONW/3zWbpjFPjE8yqXXw:Zum
Threatray	35 similar samples on MalwareBazaar
TLSH	T1A005D66DCC54012EE136D919C5A6049FF8A3260B233CE91B10CE775BAF63886B79739D
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	autohotkey
Reporter	TomU
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

129

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.71735942.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a246a8b2f0f550abbfa0548

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

conhost powershell repaired

Link:

https://www.filescan.io/uploads/6a2477e9099ef368af2403f0/reports/d2578e93-758b-4f96-8447-0e06dfe6418e/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/ac2248d66cadf6597f428cde47f98c1adbb382da0473cceca632dec08ecf3e06

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-04T01:28:00Z UTC

Last seen:

2026-06-07T10:54:00Z UTC

Hits:

~1000

Detections:

PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/ac2248d66cadf6597f428cde47f98c1adbb382da0473cceca632dec08ecf3e06/results?tab=lookup

Nucleon Malprob Susipicious

Score:

55%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/ac2248d66cadf6597f428cde47f98c1adbb382da0473cceca632dec08ecf3e06

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ac2248d66cadf6597f428cde47f98c1adbb382da0473cceca632dec08ecf3e06/

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-04 08:06:51 UTC

File Type:

Text (JavaScript)

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vqrervtmvx3fs72crtpep6mmdln3haw2arz4z3fgglpmbdwphyda._file

Threatray purecrypter stubrunner

Verdict:

malicious

Label(s):

purecrypter

Alert

Create hunting rule

stubrunner

Alert

Create hunting rule

Similar samples:

0b5a58e5857df0a3f5c8d4be2b88dd71f5c57eaa46c59248621464fdab8df0ab

2c45ef1aff188cb3600acc5ab6909b3512d63c5aef72374a24d6c68c2280f82d

2e2ee193c322ad694600f31af19e5eeca1233bc284a8174d7ed0adaca37890b4

44d52ab509e291bcbb6059b42733d3c941155848751d29d8cf073e00b9daa230

96a66d9477bd32693422ae6aefd7dbefc1d52c2e2e510bd29d3f34f910e6ff7e

c96a683aad76996c568dbc1632d8bbc6f86324231ece63de5b067c96a2167f3c

f8ef2e6276195d1ee28eacdf26e9c5f4eac9a78c2a42f5896253749a7664944d

+ 25 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260606-yeb7fact4k/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Checks computer location settings

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ac2248d66cadf6597f428cde47f98c1adbb382da0473cceca632dec08ecf3e06