MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca5810f59ac46fbd7348f7ceaedff268a412bd29fde6e2105b0823c462296b66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ca5810f59ac46fbd7348f7ceaedff268a412bd29fde6e2105b0823c462296b66
SHA3-384 hash:	c92fb8a853d77fd49713824e796ffa3252a57cd2120b320be79dff7e3c377009b6b04634b2725e2709217e2bfacbc390
SHA1 hash:	4eb636c89ffbd61bdf5c8152f5cecb116bcb5590
MD5 hash:	915e0a9b8dffb72a97d70f8be30daa44
humanhash:	xray-utah-snake-west
File name:	Payment Advice PDF.JS
Download:	download sample
Signature	PhantomStealer Alert Create hunting rule
File size:	5'137'783 bytes
First seen:	2026-07-15 07:27:14 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:Z3tbTCQI0nII/JPoc6DWJy6xa+UPX77GWOPeyRJYvea0omXvzype5GbiIcHq6AUl:Z4Ih6DZUAr7jOP7jUTjxe5bK6bQU1e3I
TLSH	T1A7367C088168B786D0ACC7A5CE0EAFEC4A1DA14BEC74DD433A1A56789F0DFD57280797
Magika	javascript
Reporter	abuse_ch
Tags:	js PhantomStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

160

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5736f056bd89099b555133

Tags:

ransomware emotet sage blic

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive masquerade obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a5736eb0c1553cf28a24cac/reports/7c5c1d2e-662c-4df5-b185-7a9608a08c31/overview

Hybrid Analysis JS/TrojanDropper.Agent

Verdict:

Malicious

Labled as:

JS/TrojanDropper.Agent

Link:

https://www.hybrid-analysis.com/sample/ca5810f59ac46fbd7348f7ceaedff268a412bd29fde6e2105b0823c462296b66

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-14T10:23:00Z UTC

Last seen:

2026-07-16T05:47:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/ca5810f59ac46fbd7348f7ceaedff268a412bd29fde6e2105b0823c462296b66/results?tab=lookup

Joe Sandbox DonutLoader, KeyLogger, MicroClip, Phant

Result

Threat name:

DonutLoader, KeyLogger, MicroClip, Phant

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1942666

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

Contains functionality to compare user and computer (likely to detect sandboxes)

Early bird code injection technique detected

Found API chain indicative of debugger detection

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

JavaScript source code contains functionality to generate code involving a shell, file or stream

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Modifies existing user documents (likely ransomware behavior)

Multi AV Scanner detection for dropped file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Queues an APC in another process (thread injection)

Sigma detected: WScript or CScript Dropper

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Yara detected DonutLoader

Yara detected Keylogger Generic

Yara detected MicroClip

Yara detected Phantom stealer

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ca5810f59ac46fbd7348f7ceaedff268a412bd29fde6e2105b0823c462296b66

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ca5810f59ac46fbd7348f7ceaedff268a412bd29fde6e2105b0823c462296b66/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zjmbb5m2yrx3242i67hk5x7sncsbfpjj7xtoeec3bar4iyrjnnta._file

Threatray phantomstealer donutloader

Verdict:

malicious

Label(s):

phantomstealer

Alert

Create hunting rule

donutloader

Alert

Create hunting rule

Similar samples:

error

PhantomStealer

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader collection credential_access discovery execution loader persistence spyware stealer

Link:

https://tria.ge/reports/260715-ja5wmaev2l/

Behaviour

Enumerates system info in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Accesses Microsoft Outlook profiles

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Uses browser remote debugging

Detects DonutLoader

Family: DonutLoader

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/ca5810f59ac46fbd7348f7ceaedff268a412bd29fde6e2105b0823c462296b66