MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c86aa51632a82ae28d0312d0b7b22b1ddabeab50e5b7a2012fbd7bd3d80971f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c86aa51632a82ae28d0312d0b7b22b1ddabeab50e5b7a2012fbd7bd3d80971f7
SHA3-384 hash:	f454cdc08cae4db622b6354da0fc7eab9356e3e4d2ca603f757e34c8a46338fef02a62448979774956f805fd1d8de9d7
SHA1 hash:	1a3bd1727d63bb61fbecd0541f3b255cdb9dfaa5
MD5 hash:	c62ecf9cc7766a5516163add570bff31
humanhash:	fifteen-magazine-jupiter-july
File name:	Comprobante de pago BANORTE.js
Download:	download sample
File size:	318'230 bytes
First seen:	2026-09-01 06:19:06 UTC
Last seen:	2026-09-01 11:59:40 UTC
File type:	js
MIME type:	text/plain
ssdeep	768:wDO6gjhhhgjj9eMZcdKX1yqM7+QRWilmrSrnRThRrIrSRTDde51ykIOoP4IQLxe0:4ghgfoMZcyIiI7NO7gc
TLSH	T1466467C8772556657266E3EDF2EE1811FB244126385B4EE7B0AF40652F72822D4CBCF8
Magika	javascript
Reporter	abuse_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

133

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6a966f12cb16783b19bd5b30/reports/e5016b56-5cc9-450e-af28-9986127a4d29/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/c86aa51632a82ae28d0312d0b7b22b1ddabeab50e5b7a2012fbd7bd3d80971f7

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-08-31T15:07:00Z UTC

Last seen:

2026-09-02T04:52:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/c86aa51632a82ae28d0312d0b7b22b1ddabeab50e5b7a2012fbd7bd3d80971f7/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1966533

Signature

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Creates processes via WMI

Drops script or batch files to the startup folder

Javascript file is likely language aware (will only work on specific systems)

JavaScript source code contains functionality to generate code involving a shell, file or stream

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

Multi AV Scanner detection for submitted file

Obfuscated command line found

Sigma detected: Drops script at startup location

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c86aa51632a82ae28d0312d0b7b22b1ddabeab50e5b7a2012fbd7bd3d80971f7/

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-09-01 00:44:32 UTC

File Type:

Text (JavaScript)

AV detection:

5 of 36 (13.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zbvkkfrsvavofdidclilpmrldxnl5k2q4w32eajpxv55hwajoh3q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/260901-g4dm5ahp4y/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Network Service Discovery

Creates a file in the Startup directory

Badlisted process makes network request

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://munihuacho.gob.pe//sifyWeb/MSI_PRO.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.