MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad003daf9429a855d165cde5b5e558ccebc55b8b39d28dc3f7c93940652bf74e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ad003daf9429a855d165cde5b5e558ccebc55b8b39d28dc3f7c93940652bf74e
SHA3-384 hash:	f4a2b2ae50c432f982ed98f3698dc046e9f70c73e7a1aa2092279a3580f28b59a56f462fae929ce084f32ae9d64112c0
SHA1 hash:	dcaa8e4cfc2282fd94bdfbea09f37e19af3ce747
MD5 hash:	f07dc86affb08817ffbbb005f3be6ebe
humanhash:	magazine-hamper-hawaii-pizza
File name:	documento_pdf.js
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	26'933 bytes
First seen:	2026-02-24 07:04:29 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:3uIa+5LgWQ23boyC+qd94ZU7HrQdr+iLIKncBl7p339GfoFZj1nG+Cp+Kg6nlC:eIaq8MhCLUsHrQfnsBQo
TLSH	T13DC222CCBED6F6A0032271333D1BB326E6EA5C81B14CD5E8F267A19CE994754D4B2B14
Magika	javascript
Reporter	JAMESWT_WT
Tags:	js xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

93

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.99368632.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Script.SNH-gen.64471817.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=699d4dbac950ab5d9ab121d7

Tags:

downloader shell virus

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aspnet_compiler asyncrat base64 evasive evasive exploit lolbin masquerade obfuscated obfuscated powershell reconnaissance repaired

Link:

https://www.filescan.io/uploads/699d4dba10e80629d4efb149/reports/26435663-73e5-46f7-ab1e-8f527502dee9/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ad003daf9429a855d165cde5b5e558ccebc55b8b39d28dc3f7c93940652bf74e

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

Link:

https://opentip.kaspersky.com/ad003daf9429a855d165cde5b5e558ccebc55b8b39d28dc3f7c93940652bf74e/results?tab=lookup

Nucleon Malprob Malware

Score:

89%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ad003daf9429a855d165cde5b5e558ccebc55b8b39d28dc3f7c93940652bf74e

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ad003daf9429a855d165cde5b5e558ccebc55b8b39d28dc3f7c93940652bf74e/

Neiki Family.XWORM

Verdict:

Malicious

Threat:

Family.XWORM

Link:

https://tip.neiki.dev/file/ad003daf9429a855d165cde5b5e558ccebc55b8b39d28dc3f7c93940652bf74e

ReversingLabs TitaniumCloud Script.Trojan.Heuristic

Threat name:

Script.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-02-19 13:11:21 UTC

File Type:

Text (JavaScript)

AV detection:

10 of 36 (27.78%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vuad3l4ufguflulfzxs3lzkyztv4kw4lhhji3q7xze4uazjl65ha._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm discovery execution rat trojan

Link:

https://tria.ge/reports/260224-hwpwvsd14e/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Contacts third-party web service commonly abused for C2

Checks computer location settings

Badlisted process makes network request

Detect Xworm Payload

Xworm

Xworm family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ad003daf9429a855d165cde5b5e558ccebc55b8b39d28dc3f7c93940652bf74e