MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca08bc376eae87f6c4b964e127f97ff16b1790632c6339dde3c7300481026ad0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ca08bc376eae87f6c4b964e127f97ff16b1790632c6339dde3c7300481026ad0
SHA3-384 hash:	e3b0748795b486a7453f4ac30d165aa05e82774164e3da3e94fca9e71df63c983f041bb052d06b8dd00d3dcb3e79d7b4
SHA1 hash:	51aa6f6ac2abd5c2a51b986534a2aa2693453d22
MD5 hash:	74864d36d95681dc28b79ef80ee22872
humanhash:	wisconsin-oscar-ceiling-cold
File name:	Payment_Advice.Pdf.js
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	1'559 bytes
First seen:	2025-05-09 14:55:57 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	24:pLvXByM99hZ9QQhiO79efeeQNQuqNBO75J6LQurWD1m1Mi4I1bf:lvZ1dPdI1bf
Threatray	989 similar samples on MalwareBazaar
TLSH	T1C031C27F988CD6C818633343D17A42CA81C367412F5167A356931E47A70EE2316F0954
Magika	javascript
Reporter	abuse_ch
Tags:	js MassLogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

394

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.30049.18490.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=681e1a1e4a59e5a2ce03669a

Tags:

spawn hype

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade obfuscated

Link:

https://www.filescan.io/uploads/681e17d9b880b22541aa5d78/reports/947e164a-82b9-4c52-86b7-2d50ad6bc446/overview

Hybrid Analysis Trojan.Script.Heuristic

Verdict:

Malicious

Labled as:

Trojan.Script.Heuristic

Link:

https://www.hybrid-analysis.com/sample/ca08bc376eae87f6c4b964e127f97ff16b1790632c6339dde3c7300481026ad0

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1685640

Signature

Connects to a pastebin service (likely for C&C)

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sample has a suspicious name (potential lure to open the executable)

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

System process connects to network (likely due to code injection or exploit)

Uses an obfuscated file name to hide its real file extension (double extension)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

85%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ca08bc376eae87f6c4b964e127f97ff16b1790632c6339dde3c7300481026ad0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ca08bc376eae87f6c4b964e127f97ff16b1790632c6339dde3c7300481026ad0/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-05-09 12:46:41 UTC

File Type:

Text (JavaScript)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zielyn3ov2d7nrfzmtqsp6l76fvrpeddfrrttxpdy4yajaicnlia._file

Threatray novastealer

Verdict:

malicious

Label(s):

novastealer

Alert

Create hunting rule

Similar samples:

3bed682a9298367059c63e05f0b565dbad9f5959302f239c00a92eb3aeb16d67

MassLogger

3eb8c9eabc1103144e34043483c923c576ceba5e2a64a0e98c6ef12160b8ac91

MassLogger

52b14f500beb10959b5593c5531322e9b048ee299295b4bf1bb1657091308dba

MassLogger

55751f7c65bff12a828fba02b49f9471869fb56108c1cfb919120f9bd4211660

MassLogger

c7de64db20145557f5070412a4e15d4d2a00487974e8fce0f4bc3ee42999bd04

MassLogger

error

MassLogger

+ 979 additional samples on MalwareBazaar

Hatching Triage masslogger

Result

Malware family:

masslogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:masslogger collection discovery execution spyware stealer

Link:

https://tria.ge/reports/250509-sbvxgsxkw9/

Behaviour

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

MassLogger

Masslogger family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ca08bc376eae87f6c4b964e127f97ff16b1790632c6339dde3c7300481026ad0