MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cefd48d22cae93ae7116f8f731fdc245b19191e56944672cd04918374b5eb8fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cefd48d22cae93ae7116f8f731fdc245b19191e56944672cd04918374b5eb8fc
SHA3-384 hash:	5a5688885e2f338cf3f743346bca146a9bc01cd6509b68a6d22be83aa758a9a12b00085f24af632d0cc940a7f2f4767e
SHA1 hash:	e6b1a344b6a5f25d8dc81e050665e13e54356fc1
MD5 hash:	5fa2a15817f06ba8ebfc21f37378a15d
humanhash:	black-cat-delta-uniform
File name:	SOA_CD105474 _ TF912Z P10406 MGR-08-10....Pdf.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	3'050'654 bytes
First seen:	2026-08-10 12:23:55 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	49152:m2jqBFAiHsZXCGUuv6etWxY4YFD9f5S53wHOPwgTh4NMVhNrQXll8cPb/QCG+kgo:xq4Ufuyef4YFD9f5S5guPwgThQMVhZQy
TLSH	T1C8E5D4822B809D33B731AB9D523ADDF0DA0A511314C5DF1630ADF6187B6DD0BA758AF2
Magika	javascript
Reporter	James_inthe_box
Tags:	AgentTesla exe js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

154

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Muldrop.1386.15608.28965.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a79c2f9390d1165c1c3ad60/reports/f1d45cda-7d52-41bb-ae5e-84fcc9bac8fc/overview

Hybrid Analysis JS/TrojanDropper.ModiLoader

Verdict:

Malicious

Labled as:

JS/TrojanDropper.ModiLoader

Link:

https://www.hybrid-analysis.com/sample/cefd48d22cae93ae7116f8f731fdc245b19191e56944672cd04918374b5eb8fc

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-08-10T01:49:00Z UTC

Last seen:

2026-08-12T10:39:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/cefd48d22cae93ae7116f8f731fdc245b19191e56944672cd04918374b5eb8fc/results?tab=lookup

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/cefd48d22cae93ae7116f8f731fdc245b19191e56944672cd04918374b5eb8fc

Malva.RE

Gathering data

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/cefd48d22cae93ae7116f8f731fdc245b19191e56944672cd04918374b5eb8fc/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z36ururmv2j244iw7d3td7ociwyzdepfnfcgolgqjemdos26xd6a._file

Threatray AgentTesla DonutLoader

Verdict:

malicious

Label(s):

AgentTesla

Alert

Create hunting rule

DonutLoader

Alert

Create hunting rule

Link:

https://reports.threatray.com/e5e90fe5-7e99-4bff-bb16-5bbe358b7c51

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader collection discovery execution keylogger loader spyware stealer trojan

Link:

https://tria.ge/reports/260810-pk89paycpb/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VMRay AgentTesla

Malware family:

AgentTesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cefd48d22cae/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cefd48d22cae93ae7116f8f731fdc245b19191e56944672cd04918374b5eb8fc