MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d611362ce8941f294ddbc94bacfe19c185a09b7bf94b782df063f8f4cc17133c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d611362ce8941f294ddbc94bacfe19c185a09b7bf94b782df063f8f4cc17133c
SHA3-384 hash:	5b7a64b42bc87183efd49887c4aad50288cd0abb4c3ddf74f4138537a92cc7dc382261ae57fafb0f32489b53823a9ec4
SHA1 hash:	36c7c71ed47e8eeb42ea4cc6afa43f23696f93fe
MD5 hash:	b7c028f705cf5019e6a0c4da16f5bbc8
humanhash:	nebraska-north-carpet-johnny
File name:	Enquiry-Dubai.js
Download:	download sample
File size:	3'913'392 bytes
First seen:	2025-12-10 12:51:18 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:Snnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnx:uxN
TLSH	T17606020E735C2670F5A36639DD175E815139717AAA82202775082DF9CF2C33C9F52D79
Magika	javascript
Reporter	abuse_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

85

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.66949221.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69396cd1a675b653bd0fbc36

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated repaired

Link:

https://www.filescan.io/uploads/69396cca1eac7b9b76a3c206/reports/507e4c18-728d-44ba-8765-b730bb2feebb/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/d611362ce8941f294ddbc94bacfe19c185a09b7bf94b782df063f8f4cc17133c

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2025-12-10T02:41:00Z UTC

Last seen:

2025-12-12T10:24:00Z UTC

Hits:

~100

Detections:

HEUR:Trojan-Downloader.Script.Generic Trojan-Downloader.JS.SLoad.sb

Link:

https://opentip.kaspersky.com/d611362ce8941f294ddbc94bacfe19c185a09b7bf94b782df063f8f4cc17133c/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1830211

Signature

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected Generic JS Downloader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/d611362ce8941f294ddbc94bacfe19c185a09b7bf94b782df063f8f4cc17133c

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Link:

https://app.malva.re/file/b7c028f705cf5019e6a0c4da16f5bbc8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d611362ce8941f294ddbc94bacfe19c185a09b7bf94b782df063f8f4cc17133c/

Neiki Trojan-Downloader.JS.SLoad

Verdict:

Malicious

Threat:

Trojan-Downloader.JS.SLoad

Link:

https://tip.neiki.dev/file/d611362ce8941f294ddbc94bacfe19c185a09b7bf94b782df063f8f4cc17133c

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-12-10 07:25:02 UTC

File Type:

Binary

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2yitmlhisqpssto3zff2z7qzygc2bg337ffxqlpqmp4pjtaxcm6a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/251210-p3m46sev4b/

Behaviour

Command and Scripting Interpreter: JavaScript

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/d611362ce8941f294ddbc94bacfe19c185a09b7bf94b782df063f8f4cc17133c