MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d483519637f670022a8e862bfbb12247abe0d31abd3f048cfe9ff559ac9dd1c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d483519637f670022a8e862bfbb12247abe0d31abd3f048cfe9ff559ac9dd1c3
SHA3-384 hash:	22d8c8afffb64176f28978f41ce9762ce4814970a34efbf6d3524d5ecc6271a460e60676c1c6ba428fed3e437efa0f5f
SHA1 hash:	dc7c4be5cdd1c74837098845bf01d252379a996f
MD5 hash:	c94ec89260474b6b29db3147ae60a633
humanhash:	cat-chicken-mexico-video
File name:	PYMNT_34ef6dd9-b064-480-99d0-cba2511f.js
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	1'619'064 bytes
First seen:	2026-06-25 05:52:43 UTC
Last seen:	2026-06-25 05:53:11 UTC
File type:	js
MIME type:	text/plain
ssdeep	3072:nyjagFS8TBcjh0OxLYocRwr6lHWdbBz5MNyDZqHbZg2tmaf5jiwBGOySWZkDisjo:uFGSAs9wTXXq4
Threatray	146 similar samples on MalwareBazaar
TLSH	T10775E5FCCCFBC265F3BBF99947D9362567777723312C75A042818A8902296C169C622E
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	lowmal3
Tags:	js PureLogsStealer

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

131

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Obfus-417.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.JS.Obfus-2662.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a3cc25f1548daf709f99ee3

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

conhost obfuscated powershell repaired zero-day

Link:

https://www.filescan.io/uploads/6a3cc2594dca8c24a596d10c/reports/f06ae933-671c-436e-ab31-2c94bab39639/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d483519637f670022a8e862bfbb12247abe0d31abd3f048cfe9ff559ac9dd1c3

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-24T20:05:00Z UTC

Last seen:

2026-06-26T04:15:00Z UTC

Hits:

~1000

Detections:

PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/d483519637f670022a8e862bfbb12247abe0d31abd3f048cfe9ff559ac9dd1c3/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1933528

Signature

.NET source code contains potential unpacker

Creates a thread in another existing process (thread injection)

Creates an undocumented autostart registry key

Injects a PE file into a foreign processes

JScript performs obfuscated calls to suspicious functions

Powershell scriptblock execution from environment variable

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d483519637f670022a8e862bfbb12247abe0d31abd3f048cfe9ff559ac9dd1c3

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d483519637f670022a8e862bfbb12247abe0d31abd3f048cfe9ff559ac9dd1c3/

Neiki Trojan.Win32

Verdict:

Malicious

Threat:

Trojan.Win32

Link:

https://tip.neiki.dev/file/d483519637f670022a8e862bfbb12247abe0d31abd3f048cfe9ff559ac9dd1c3

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2sbvdfrx6zyaekuoqyv7xmjci6v6buy2xu7qjdh6t72vtle52hbq._file

Threatray purecrypter

Verdict:

malicious

Label(s):

purecrypter

Alert

Create hunting rule

Similar samples:

026b15d1583065e220e4c9c55173fcf3122fd25cb972380b7206cbbb920c2de8

PureLogsStealer

1c4a7c2235c522107a2934f5fcc0d9dea43dd9343c3864d73c456a00116c0fe6

PureLogsStealer

3e982ec9ece55bc3e565186182caea369338d277c078f4380fe2258342ca4893

PureLogsStealer

5c2d1d2a8c862b64dac930035cb1f27f4c377bad633f03b7e2539e96d558c9eb

PureLogsStealer

5f639000b51ef2dfc776bcea1795b9920d001c422fc406bca72a379f8ce152d7

PureLogsStealer

b4a92c16dc941c5a22a0d619bbd893930a7138d9437f5af145b73051589d0a9c

PureLogsStealer

d47f924db4419333233cd215eaaea037983b7ab00d63274c5f4125227f80e920

PureLogsStealer

d94a6d8e3d54432fcdb888a4f1e566f35c9ea8fc04381956f5e836da50390ee8

PureLogsStealer

error

PureLogsStealer

+ 136 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection discovery execution persistence

Link:

https://tria.ge/reports/260625-glhjcshv2s/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Time Discovery

Drops file in Windows directory

Accesses Microsoft Outlook profiles

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d483519637f670022a8e862bfbb12247abe0d31abd3f048cfe9ff559ac9dd1c3