MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b271d12f4da306da079d7592f4611ffbd1f4c0a10f62031fc1d96a259728f96d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b271d12f4da306da079d7592f4611ffbd1f4c0a10f62031fc1d96a259728f96d
SHA3-384 hash:	045da544e6b2c8ad38ff5a70526200f36954dc364392d1efd819142cfc95304443c4683738b2c364fb0cd6c7a2c81e1d
SHA1 hash:	856cba394efac37e781213fa1d22480b163db58f
MD5 hash:	d4d527f704af41adedfa6d4322417a9f
humanhash:	avocado-aspen-double-london
File name:	WGT1546.Pdf.JS
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	2'579'017 bytes
First seen:	2026-06-22 15:26:09 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	49152:YJEJsodWowV7PwJA6L0ahqq4FDuiLWAR8/5hhUOdDWQoy:wEJsodXwrwJA6LPhqq4xlLfR8/5hhUOl
Threatray	408 similar samples on MalwareBazaar
TLSH	T161C55C488960F38AD5A8CBB19C0F6FF4560E940BED24DD03361B966A8F84FC736546E7
Magika	javascript
Reporter	abuse_ch
Tags:	js xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

139

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a39555886bc95245bf8b58d

Tags:

keylog blic word

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug base64 dropper evasive obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a39549e90632a45f7334443/reports/adecb28a-57e1-4686-9539-b6a6abd6105b/overview

Hybrid Analysis JS/TrojanDropper.Agent

Verdict:

Suspicious

Labled as:

JS/TrojanDropper.Agent

Link:

https://www.hybrid-analysis.com/sample/b271d12f4da306da079d7592f4611ffbd1f4c0a10f62031fc1d96a259728f96d

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-19T05:34:00Z UTC

Last seen:

2026-06-24T09:14:00Z UTC

Hits:

~100

Detections:

HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.Generic

Link:

https://opentip.kaspersky.com/b271d12f4da306da079d7592f4611ffbd1f4c0a10f62031fc1d96a259728f96d/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1932007

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Benign windows process drops PE files

Drops PE files to the document folder of the user

Drops PE files with a suspicious file extension

Hides threads from debuggers

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Suspicious Parent Double Extension File Execution

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious WerFault Winsock library load

Unusual module load detection (module proxying)

Uses an obfuscated file name to hide its real file extension (double extension)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b271d12f4da306da079d7592f4611ffbd1f4c0a10f62031fc1d96a259728f96d

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b271d12f4da306da079d7592f4611ffbd1f4c0a10f62031fc1d96a259728f96d/

Neiki Family.XWORM

Verdict:

Malicious

Threat:

Family.XWORM

Link:

https://tip.neiki.dev/file/b271d12f4da306da079d7592f4611ffbd1f4c0a10f62031fc1d96a259728f96d

ReversingLabs TitaniumCloud Win32.Trojan.Egairtigado

Threat name:

Win32.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-22 02:24:36 UTC

File Type:

Text (JavaScript)

AV detection:

15 of 38 (39.47%)

Threat level:

  5/5

Threatray xworm

Verdict:

malicious

Label(s):

xworm

Alert

Create hunting rule

Similar samples:

153a492ed524469bc8fd9a9fcd4d0ec3215caa4b0bb1e34bd779fad17271b56a

XWorm

288e9320f7582f388ffdd93f00efebf60bf95e672804dc703da00eac890cb661

XWorm

30ded8132af61b659fed8f7cb246ac33ae92821241d14a427a53521b331df877

XWorm

6f8c26cc1096a3d10169efc5a2eba3f0370b905b3322b839e9af3bcbad540748

XWorm

8be9560f26392b4e905203d1464ab7e6bb17c0091b3a346fa443867b6b9d8e41

XWorm

8dffead0450847a53d2c7d585aa2150acc44a4813ecbd31f0e7f6c61d7b08c05

XWorm

be4308b1266c148eb7c778aa68d58dffb1350aa556d7bd58d8ff3a0d2ad449fa

XWorm

d15248555e7a2d9c279d219e6587a74fca9c25720194512a2e4b0757f7a63219

XWorm

dc12faa460faab18a12d8ac33fb3a3a96c95232cff2f124df15300475cc20486

XWorm

ea84300a2c8500206df527ef2d2559a328e9b3efd41717c1a4d3e865d602c316

XWorm

error

XWorm

+ 398 additional samples on MalwareBazaar

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm discovery execution rat trojan

Link:

https://tria.ge/reports/260622-sw191ady9m/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks computer location settings

Executes dropped EXE

Detect Xworm Payload

Family: Xworm

Malware Config

C2 Extraction:

watchthisyear.gotdns.ch:7474

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/b271d12f4da306da079d7592f4611ffbd1f4c0a10f62031fc1d96a259728f96d