MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7e1640d970a92a0deb57a39b633bee0ce8825e1f280a630493f565e100b2c05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7e1640d970a92a0deb57a39b633bee0ce8825e1f280a630493f565e100b2c05
SHA3-384 hash: 49c1cc42a2716f470ecc7c7d7c4f05e42c2e75aeb0850b00942fefc28c24ad0bae6b708c984c0c81efc882fa2ede1bef
SHA1 hash: 95938ac9e7cb83be9ad8cefb0d3a9738c05e2dac
MD5 hash: bb515229dcb55af9bef478f08c00143e
humanhash: timing-whiskey-iowa-four
File name:QUOTATION_72345523.js
Download: download sample
File size:1'057'459 bytes
First seen:2026-08-21 08:34:10 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 384:ISxvkEHgh+cGgXgDNgTRnDqn6sPAGpz1mH0L0yZ:1cGhoH0LD
TLSH T1EC25B32B746A94E36B7E31799E1A754F73A63B1FDA8343C230C7228B45B3C7552C9812
Magika javascript
Reporter abuse_ch
Tags:js

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.JS.DownLoader.10768.8386.31432.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Labled as:
JS/TrojanDownloader.Agent
Link:
https://www.hybrid-analysis.com/sample/c7e1640d970a92a0deb57a39b633bee0ce8825e1f280a630493f565e100b2c05
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1961678
Signature
Bypasses PowerShell execution policy
Creates processes via WMI
JavaScript source code contains functionality to generate code involving a shell, file or stream
Multi AV Scanner detection for submitted file
Obfuscated command line found
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c7e1640d970a92a0deb57a39b633bee0ce8825e1f280a630493f565e100b2c05/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y7qwidmxbkjkbxvvpi43mm564dhiqjpb6kakmmcjh5lf4ealfqcq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution
Link:
https://tria.ge/reports/260821-kgj36sbj9v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Badlisted process makes network request
Process spawned unexpected child process
Malware Config
Dropper Extraction:
https://tmpfiles.org/dl/1787161037.c81e7dba2550050a/wXw6relOYfKE/msi_pro.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/c7e1640d970a92a0deb57a39b633bee0ce8825e1f280a630493f565e100b2c05

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments