MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc16cf19075de6200a10d31a5f8775461c6d98c0d2f41d2b59c1ed28659b62c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bc16cf19075de6200a10d31a5f8775461c6d98c0d2f41d2b59c1ed28659b62c3
SHA3-384 hash:	dde406aa5745ba24e7e553ee8fa8e0199ad57b8ba146d2ab628511120f72ce8e2910b46a7d5c9ddd28340dbf036521e3
SHA1 hash:	482cd8cd4d031510877d0b78230649cac0043e6d
MD5 hash:	e0ede72356471d6358a9e85241062210
humanhash:	timing-east-echo-alanine
File name:	Purchase Order July -CEDF9837E748834938393003872143_docx.js
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	1'037'817 bytes
First seen:	2026-08-10 12:48:30 UTC
Last seen:	2026-08-18 19:08:39 UTC
File type:	js
MIME type:	text/plain
ssdeep	12288:Jkg55il92UK812V0Rx8goUW1imeeuTj5FRGB9Sux+/t5TKp75iLk73INHDCRMSl2:U
TLSH	T112250EDB9F75D68906287D6EC83CBE9D299BCD9000D0AA5BFDB88147F70E64901C4B1E
Magika	javascript
Reporter	lowmal3
Tags:	js PureLogsStealer

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

121

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.DownLoader.10718.13701.15754.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.JS.DownLoader.10718.31719.29920.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac5032d810478c229f0b1bb

Tags:

shell virus sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive forfiles lolbin masquerade repaired

Link:

https://www.filescan.io/uploads/6a79c8da69834dc680693c62/reports/8bf6a727-fdd3-444d-a7d5-81beccde4d13/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/bc16cf19075de6200a10d31a5f8775461c6d98c0d2f41d2b59c1ed28659b62c3

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2026-08-10T02:07:00Z UTC

Last seen:

2026-08-12T11:19:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/bc16cf19075de6200a10d31a5f8775461c6d98c0d2f41d2b59c1ed28659b62c3/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1955085

Signature

Creates a thread in another existing process (thread injection)

Creates an undocumented autostart registry key

Injects a PE file into a foreign processes

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suspicious execution chain found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

91%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bc16cf19075de6200a10d31a5f8775461c6d98c0d2f41d2b59c1ed28659b62c3

Malva.RE

Gathering data

CERT.PL MWDB purelogs

Detection:

purelogs

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/bc16cf19075de6200a10d31a5f8775461c6d98c0d2f41d2b59c1ed28659b62c3/

ReversingLabs TitaniumCloud Script-JS.Trojan.Cryxos

Threat name:

Script-JS.Trojan.Cryxos

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-10 04:54:27 UTC

File Type:

Text (JavaScript)

AV detection:

6 of 36 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xqlm6gihlxtcacqq2mnf7b3viyog3gga2l2b2k2zyhwsqzm3mlbq._file

Threatray PureCrypter

Verdict:

malicious

Label(s):

PureCrypter

Alert

Create hunting rule

Link:

https://reports.threatray.com/85093848-ad61-4bd9-840c-29dbd3f7e2ba

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection defense_evasion discovery execution persistence

Link:

https://tria.ge/reports/260810-p2npbahn8t/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

System Time Discovery

Accesses Microsoft Outlook profiles

Checks computer location settings

Indirect Command Execution

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Downloads MZ/PE file

VMRay PureHVNC

Malware family:

PureHVNC

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bc16cf19075d/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bc16cf19075de6200a10d31a5f8775461c6d98c0d2f41d2b59c1ed28659b62c3