MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1e10862cf3d2a120dee559ebdb0a77ab34ccfe3379c6733c35c9e5ee6051a64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c1e10862cf3d2a120dee559ebdb0a77ab34ccfe3379c6733c35c9e5ee6051a64
SHA3-384 hash:	3f8dcd2dd7c1514e25ff3988cc4e3277ba9d19ad89e1380a032c557806a42c0878a59c66ec75c04b1a6b5bf36255d72a
SHA1 hash:	ba869509c52e0f2f680ef8d17f34edade4d41aa2
MD5 hash:	dadbb7e50c6eb699384c93ebd43c3826
humanhash:	magnesium-wisconsin-connecticut-seven
File name:	Surat (Q2)_pdf.js
Download:	download sample
File size:	4'836 bytes
First seen:	2026-11-12 09:30:32 UTC
Last seen:	Never
File type:	js
MIME type:	application/javascript
ssdeep	48:aRTteYP1TXnX/r+CXJWwjN0+8TwVZurqrqRqIrqnHRxFqD:KtN97X/tY8aTwV4rKqRvMxxFo
TLSH	T103A19A8C6C85A0684936F37D9B7FA60DFB2649270249C658FC9D96A02F7042582FCFDD
Magika	javascript
Reporter	abuse_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

167

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af5886fc48f25399eb55330

Tags:

proxy java

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive masquerade powershell repaired

Link:

https://www.filescan.io/uploads/6af58767f88d3762ec6a3258/reports/00476da4-8b33-4cb9-bacb-8ee89ee66eb4/overview

Hybrid Analysis SVM:TrojanDownloader/JS.Nemucod

Verdict:

Malicious

Labled as:

SVM:TrojanDownloader/JS.Nemucod

Link:

https://www.hybrid-analysis.com/sample/c1e10862cf3d2a120dee559ebdb0a77ab34ccfe3379c6733c35c9e5ee6051a64

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

Link:

https://opentip.kaspersky.com/c1e10862cf3d2a120dee559ebdb0a77ab34ccfe3379c6733c35c9e5ee6051a64/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/2004556

Signature

Antivirus detection for URL or domain

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected Generic JS Downloader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/c1e10862cf3d2a120dee559ebdb0a77ab34ccfe3379c6733c35c9e5ee6051a64

Malva.RE Malware

Verdict:

Malware

YARA:

2 match(es)

Tags:

Javascript JS Emulation Trace MSXML2.XMLHTTP PowerShell Scripting.FileSystemObject T1059.007 T1105

Link:

https://app.malva.re/file/dadbb7e50c6eb699384c93ebd43c3826

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c1e10862cf3d2a120dee559ebdb0a77ab34ccfe3379c6733c35c9e5ee6051a64/

ReversingLabs TitaniumCloud Script-JS.Backdoor.FormBook

Threat name:

Script-JS.Backdoor.FormBook

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-11-12 02:56:56 UTC

File Type:

Text (JavaScript)

AV detection:

13 of 38 (34.21%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yhqqqywphuvbedpokwpl3mfhpkzuzt7dg6ogom6dlspf5zqfdjsa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261112-lg8xzaec57/

Behaviour

Command and Scripting Interpreter: JavaScript

Reads the TCP/IP host and domain name from the registry

Badlisted process makes network request

VirusSign affk

Malware Family:

affk

Alert

Create hunting rule

Malicious:

True

Tags:

javascript

Link:

https://intel.virussign.com/intelligence/file/c1e10862cf3d2a120dee559ebdb0a77ab34ccfe3379c6733c35c9e5ee6051a64

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c1e10862cf3d2a120dee559ebdb0a77ab34ccfe3379c6733c35c9e5ee6051a64