MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb35a00f5da453cf95d189e88873a7cb95d168aa69b80db07ea67fa2c35895d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bb35a00f5da453cf95d189e88873a7cb95d168aa69b80db07ea67fa2c35895d0
SHA3-384 hash:	e1275ccbe85d007ff35e5783380393d175aadf4da109ebc481013bd8eac9f4833241f13190147b44ba3868f4c24d4100
SHA1 hash:	ad275d2e94e56ae8485ae8cce44f8c602db7592c
MD5 hash:	7af9ed7817cc33c37294d6a2c4ae828e
humanhash:	fillet-potato-vegan-tennessee
File name:	RFQ_EMS-PFC-2026009530.js
Download:	download sample
File size:	2'220'428 bytes
First seen:	2026-07-03 18:03:42 UTC
Last seen:	2026-07-24 12:18:15 UTC
File type:	js
MIME type:	text/plain
ssdeep	768:2BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBa:p
TLSH	T13FA5AF7E1FCAB46AC03757268D6A3974DC009AB739DA04423E3B3BCCA714761E151EB6
Magika	javascript
Reporter	TomU
Tags:	js

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

139

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.45725999.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a47fa68762b0b26f3cf7bcc

Tags:

dwnldr virus agent

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 downloader fingerprint powershell repaired

Link:

https://www.filescan.io/uploads/6a47fa34df45f8126e155abd/reports/da9db6a5-a4fd-43f3-98e2-d774b072969b/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/bb35a00f5da453cf95d189e88873a7cb95d168aa69b80db07ea67fa2c35895d0

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-01T06:57:00Z UTC

Last seen:

2026-07-04T18:42:00Z UTC

Hits:

~1000

Detections:

Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.Generic Trojan.VBS.SAgent.sb

Link:

https://opentip.kaspersky.com/bb35a00f5da453cf95d189e88873a7cb95d168aa69b80db07ea67fa2c35895d0/results?tab=lookup

Nucleon Malprob Benign

Score:

10%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/bb35a00f5da453cf95d189e88873a7cb95d168aa69b80db07ea67fa2c35895d0

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bb35a00f5da453cf95d189e88873a7cb95d168aa69b80db07ea67fa2c35895d0/

Neiki Trojan.VBS.SAgent

Verdict:

Malicious

Threat:

Trojan.VBS.SAgent

Link:

https://tip.neiki.dev/file/bb35a00f5da453cf95d189e88873a7cb95d168aa69b80db07ea67fa2c35895d0

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-01 13:01:38 UTC

File Type:

Binary

AV detection:

10 of 23 (43.48%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xm22ad25urj47forrhuiq45hzok5c2fkng4a3md6uz72fq2ysxia._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/260703-wnww4adx4s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.71

Link:

https://yomi.yoroi.company/submissions/bb35a00f5da453cf95d189e88873a7cb95d168aa69b80db07ea67fa2c35895d0