MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2ec143140403176ca4090160ee57b032da3b6b11bb2e5214186ee49cf055166. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d2ec143140403176ca4090160ee57b032da3b6b11bb2e5214186ee49cf055166
SHA3-384 hash:	77439ca3e0ed80645b8989b57cce8e3295f0430c3691b6b9b368e3c13eb357ced756d46258b39fe39a66e9d03cb0ab28
SHA1 hash:	f3f71296772cfd2ef322b81e5958601e5c38f3c1
MD5 hash:	e6d55bc04c01e711b8e67377c0f00955
humanhash:	helium-november-two-nitrogen
File name:	Purchase Order.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	6'195'880 bytes
First seen:	2026-04-13 13:07:48 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:C/ARR1FbEVje0q5n38WiMOhFeRJiI2b/RI2UDJCVOtk2/8lC4fjMZVAQF6cfP3pp:CoRfaVjeP8WiMqa32zRwJ4OtZ/8lC+M7
TLSH	T1D1569408E0A4B20D58C2DF5EA53BD4B0488E7A6A6F4DCAB2B52FD87C1C55FB3851119F
Magika	javascript
Reporter	abuse_ch
Tags:	AgentTesla js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

114

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.92386175.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69dceaebf68adfe1003962c4

Tags:

autorun lien

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aes anti-vm base64 base64 crypto evasive evasive fingerprint hacktool lolbin masquerade obfuscated obfuscated obfuscated persistence powershell reconnaissance repaired schtasks

Link:

https://www.filescan.io/uploads/69dceae99124ebc0875102d5/reports/aa35b1bc-744e-4f35-96f7-369713aeb62c/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d2ec143140403176ca4090160ee57b032da3b6b11bb2e5214186ee49cf055166

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-04-13T00:02:00Z UTC

Last seen:

2026-04-15T11:38:00Z UTC

Hits:

~1000

Detections:

Trojan-PSW.Agensla.TCP.C&C PDM:Trojan.Win32.Generic HEUR:Trojan.PowerShell.Tesre.sb Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic Trojan-Spy.Stealer.FTP.C&C

Link:

https://opentip.kaspersky.com/d2ec143140403176ca4090160ee57b032da3b6b11bb2e5214186ee49cf055166/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1897371

Signature

JavaScript source code contains functionality to generate code involving a shell, file or stream

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d2ec143140403176ca4090160ee57b032da3b6b11bb2e5214186ee49cf055166

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d2ec143140403176ca4090160ee57b032da3b6b11bb2e5214186ee49cf055166/

Neiki Family.AGENTTESLA

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/d2ec143140403176ca4090160ee57b032da3b6b11bb2e5214186ee49cf055166

ReversingLabs TitaniumCloud Win32.Trojan.Qwexlafiba

Threat name:

Win32.Trojan.Qwexlafiba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-13 11:21:09 UTC

File Type:

Text (JavaScript)

AV detection:

14 of 38 (36.84%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2lwbimkaiayxnssasala5zl3amw2hnvrdozokikbq3xettyfkfta._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla execution keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/260413-qdk4yshs7z/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

Checks computer location settings

Badlisted process makes network request

Family: AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d2ec143140403176ca4090160ee57b032da3b6b11bb2e5214186ee49cf055166