MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c51e8ea6701918bfb0bb340ddaf7deea21cc6952895399baa63c6ab3fcb573ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c51e8ea6701918bfb0bb340ddaf7deea21cc6952895399baa63c6ab3fcb573ea
SHA3-384 hash:	a115ac57378ca4e3371fecb14cd9f13c0822a16272be2974e075045be0b24f8bcee7e2b404ee2f1f6300ded29c9b8cfd
SHA1 hash:	b6b761b0d256fa266d15429fd1fae6fb2a8b9b48
MD5 hash:	34fec0bf559927aa44dce7af324cdd86
humanhash:	eleven-comet-dakota-moon
File name:	OT 1537-7______________________xls.js
Download:	download sample
File size:	1'678'585 bytes
First seen:	2026-10-09 15:01:52 UTC
Last seen:	2026-10-09 16:22:19 UTC
File type:	js
MIME type:	application/javascript
ssdeep	24576:DCkJgvrKMYi/U5+G/JhwkCQk419xzIM/AcXe:E
TLSH	T1A57543F51EE11D8525B45226C3D0F09D0C637F8469EEDE641038F1B7A2F8680BB999AF
Magika	javascript
Reporter	abuse_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

163

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.81735949.43728423.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

encrypted masquerade obfuscated repaired

Link:

https://www.filescan.io/uploads/6ac9020275b484cde0330cf3/reports/d6ec4f66-51fc-40d0-a55b-1d45a7480d9c/overview

Hybrid Analysis JS/Agent.FEG

Verdict:

Suspicious

Labled as:

JS/Agent.FEG

Link:

https://www.hybrid-analysis.com/sample/c51e8ea6701918bfb0bb340ddaf7deea21cc6952895399baa63c6ab3fcb573ea

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-10-08T16:20:00Z UTC

Last seen:

2026-10-10T10:57:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/c51e8ea6701918bfb0bb340ddaf7deea21cc6952895399baa63c6ab3fcb573ea/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1984884

Signature

Found potential dummy code loops (likely to delay analysis)

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c51e8ea6701918bfb0bb340ddaf7deea21cc6952895399baa63c6ab3fcb573ea

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c51e8ea6701918bfb0bb340ddaf7deea21cc6952895399baa63c6ab3fcb573ea/

ReversingLabs TitaniumCloud Script-JS.Packed.Generic

Threat name:

Script-JS.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-10-08 19:09:39 UTC

File Type:

Text (JavaScript)

AV detection:

5 of 36 (13.89%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yupi5jtqdeml7mf3gqg5v5665iq4y2ksrfjztovghrvlh7fvopva._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/261009-sern8sytcs/

Behaviour

Command and Scripting Interpreter: JavaScript

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.