MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c258229ec4b1519fb02c5df196b774f131c7d60cf650ff59ca7c97f53d4b9434. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c258229ec4b1519fb02c5df196b774f131c7d60cf650ff59ca7c97f53d4b9434
SHA3-384 hash:	0039eb85a6b43447e5a9abd58d8a989a66733bbb3936eaac5b5995e207c5572ddff5e1dccb3d720205016218356e8fb5
SHA1 hash:	a17e45546d37cc98e0817e893130c23b2d9b7a78
MD5 hash:	6954d7c14eb40c69fda73fc9d6efc046
humanhash:	nitrogen-mountain-connecticut-alanine
File name:	SI-33488777 BAH eStatement29072026.pdf.js
Download:	download sample
File size:	4'770'126 bytes
First seen:	2026-09-29 12:22:05 UTC
Last seen:	2026-09-30 12:01:43 UTC
File type:	js
MIME type:	text/plain
ssdeep	384:pjtec1GKsf0vt+iLWCls3FCmiSNDpSwC4jFSNxnhG/KHwlCILf1xhLfX8tGMzb9b:pjtecg7mV
TLSH	T121265EC9FA01F9E1892130079A85710AB7E750C90A52CD0FBFADF6D5FA496E3B015DA3
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	James_inthe_box
Tags:	exe js

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

178

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

masquerade repaired

Link:

https://www.filescan.io/uploads/6abbad7915da624b77306a71/reports/dca43b4a-ef50-4cfd-8221-bfdd6ba5b01c/overview

Hybrid Analysis JS.Loader.1.Generic

Verdict:

Malicious

Labled as:

JS.Loader.1.Generic

Link:

https://www.hybrid-analysis.com/sample/c258229ec4b1519fb02c5df196b774f131c7d60cf650ff59ca7c97f53d4b9434

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2026-09-29T03:40:00Z UTC

Last seen:

2026-10-01T09:32:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/c258229ec4b1519fb02c5df196b774f131c7d60cf650ff59ca7c97f53d4b9434/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c258229ec4b1519fb02c5df196b774f131c7d60cf650ff59ca7c97f53d4b9434

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c258229ec4b1519fb02c5df196b774f131c7d60cf650ff59ca7c97f53d4b9434/

ReversingLabs TitaniumCloud Script-JS.Downloader.Heuristic

Threat name:

Script-JS.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-29 10:26:31 UTC

File Type:

Text (JavaScript)

AV detection:

12 of 38 (31.58%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yjmcfhwewfiz7mbmlxyznn3u6ey4pvqm6zip6wokpsl7kpklsq2a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/260929-pj17pazckd/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

Enumerates connected drives

Creates a file in the Startup directory

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/c258229ec4b1519fb02c5df196b774f131c7d60cf650ff59ca7c97f53d4b9434