MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b721bbe345a775c346e36af404ea28602c92ed7b7f451b1b9eb4e5aac6bbe976. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b721bbe345a775c346e36af404ea28602c92ed7b7f451b1b9eb4e5aac6bbe976
SHA3-384 hash:	1a364845efcb6f958fa20e883738a35503bbd52ec88abb13f26ecd30e69d22f379ff6668843d170acab1e9f941cc674c
SHA1 hash:	0631d8b428ef85e1ae5ca04460b7a7dd73f138b4
MD5 hash:	333b7c65d9d95c045d2847a95abffbed
humanhash:	nevada-nitrogen-batman-may
File name:	Proforma Invoice No. 00124 - CONFIRM.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	3'410'540 bytes
First seen:	2026-08-04 01:43:32 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:wOdQf/H+qxoJAFkYimTGINWfM3m1bccdQm+bo0jqP+LbJMyr:wv/H+/m2pvIAfA5m6qWJMyr
TLSH	T1F5F5C4421788A032777A679C533AE930D90B919714C9DF16347CD228BF6CE1793E8AF6
Magika	javascript
Reporter	nat
Tags:	AgentTesla js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

175

Origin country :

TH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.29031.BadJs.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dbatloader downloader dropper evasive formbook masquerade obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a7143ece68b14a600055f40/reports/87cefcfb-d6dc-40e4-a5a3-28222adc4215/overview

Hybrid Analysis GT:JS.ObfLoader.3

Verdict:

Malicious

Labled as:

GT:JS.ObfLoader.3

Link:

https://www.hybrid-analysis.com/sample/b721bbe345a775c346e36af404ea28602c92ed7b7f451b1b9eb4e5aac6bbe976

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-08-03T06:25:00Z UTC

Last seen:

2026-08-05T23:10:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/b721bbe345a775c346e36af404ea28602c92ed7b7f451b1b9eb4e5aac6bbe976/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b721bbe345a775c346e36af404ea28602c92ed7b7f451b1b9eb4e5aac6bbe976

Malva.RE

Gathering data

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/b721bbe345a775c346e36af404ea28602c92ed7b7f451b1b9eb4e5aac6bbe976/

ReversingLabs TitaniumCloud Script-JS.Spyware.Negasteal

Threat name:

Script-JS.Spyware.Negasteal

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-03 09:40:19 UTC

File Type:

Text (JavaScript)

AV detection:

13 of 24 (54.17%)

Threat level:

  2/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=w4q3xy2fu524grxdnl2aj2rimawjf3l3p5crwg46wts2vrv35f3a._file

Threatray AgentTesla

Verdict:

malicious

Label(s):

AgentTesla

Alert

Create hunting rule

Link:

https://reports.threatray.com/f23e0409-869d-4414-bc46-3bcdd7752b2d

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/260804-b5zdbsba38/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b721bbe345a775c346e36af404ea28602c92ed7b7f451b1b9eb4e5aac6bbe976