MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af041cdb23f2cd20fefbb99340ee1783e306ad47fad77ef683fa730cce7d2fe4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	af041cdb23f2cd20fefbb99340ee1783e306ad47fad77ef683fa730cce7d2fe4
SHA3-384 hash:	6b7065597cbe4f08edbe846b1369c40c1de07e347db67737098c2d3cebe4a7d08e2c8b13c5f6e26ab4337e8fc023d94a
SHA1 hash:	22c16af62e41ac73d5e19c6d52a83b3f4508f59b
MD5 hash:	80649b881ee3d8f9b53f559ed5df7740
humanhash:	friend-beryllium-oxygen-low
File name:	GlockenPharma_Product_Inquiry_List_pdf.js
Download:	download sample
Signature	DarkVisionRAT Alert Create hunting rule
File size:	816'443 bytes
First seen:	2026-11-13 13:38:07 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:uretXh+XrWXreSkPGxJnLzaRnVOQatZ2hMi4MeP8NMPyeOAX1Cf3LJmiWlDNDQST:n
TLSH	T156051776C2FD2E3DC4275959CD793C0C9CF054A10B4EF87AAD3764C4E97CBAA66A0260
Magika	javascript
Reporter	abuse_ch
Tags:	DarkVisionRAT js RAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

165

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af712cf0a71acf937da7406

Tags:

vmdetect autorun emotet

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Connection attempt

Sending a custom TCP request

Enabling the 'hidden' option for files in the %temp% directory

Deleting a recently created file

Creating a process with a hidden window

Searching for the window

Creating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% directory

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Setting a single autorun event

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

encrypted evasive masquerade obfuscated repaired

Link:

https://www.filescan.io/uploads/6af713147333374262d450d6/reports/79766cef-8337-4085-9a62-8eef78684cf4/overview

Hybrid Analysis GT:JS.Acsogenixx.6354

Verdict:

Malicious

Labled as:

GT:JS.Acsogenixx.6354

Link:

https://www.hybrid-analysis.com/sample/af041cdb23f2cd20fefbb99340ee1783e306ad47fad77ef683fa730cce7d2fe4

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

Link:

https://opentip.kaspersky.com/af041cdb23f2cd20fefbb99340ee1783e306ad47fad77ef683fa730cce7d2fe4/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/2005429

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal saved passwords of Firefox

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain checking for user administrative privileges

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Searches for specific processes (likely to inject)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

19%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/af041cdb23f2cd20fefbb99340ee1783e306ad47fad77ef683fa730cce7d2fe4

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/af041cdb23f2cd20fefbb99340ee1783e306ad47fad77ef683fa730cce7d2fe4/

ReversingLabs TitaniumCloud Script-JS.Downloader.Acsogenixx

Threat name:

Script-JS.Downloader.Acsogenixx

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-11-13 10:53:51 UTC

File Type:

Text (JavaScript)

AV detection:

6 of 38 (15.79%)

Threat level:

  3/5

Spamhaus Hash Blocklist

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=v4cbzwzd6lgsb7x3xgjub3qxqprqnlkh7llx55ud7jzqztt5f7sa._file

Hatching Triage darkvision

Result

Malware family:

darkvision

Alert

Create hunting rule

Score:

  10/10

Tags:

family:darkvision defense_evasion discovery execution persistence privilege_escalation ransomware rat spyware stealer

Link:

https://tria.ge/reports/261113-qx2aaact5k/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Badlisted process makes network request

Family: DarkVision Rat

Malware Config

C2 Extraction:

172.245.155.83

VirusSign acsogenixx

Malware Family:

acsogenixx

Alert

Create hunting rule

Malicious:

True

Tags:

javascript

Link:

https://intel.virussign.com/intelligence/file/af041cdb23f2cd20fefbb99340ee1783e306ad47fad77ef683fa730cce7d2fe4

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.