🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da8d7a294c004ee2ac8ef63a2b561eb1dfdea4315fc0c7babc76562bd8eff28f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da8d7a294c004ee2ac8ef63a2b561eb1dfdea4315fc0c7babc76562bd8eff28f
SHA3-384 hash: 5efc0713a540906ad0a0943c5cf259205fe662dc4c70cdfb7ad87f20af3b4cf1465ae404fe5440b8a19c4d0edad461af
SHA1 hash: 770834e331dc2821b8a45d320ba54ef6d3adf60b
MD5 hash: 8b136a22819cbf1e565c1be8ba7e43cc
humanhash: two-eighteen-lamp-yellow
File name:da8d7a294c004ee2ac8ef63a2b561eb1dfdea4315fc0c7babc76562bd8eff28f
Download: download sample
File size:3'550'901 bytes
First seen:2026-11-01 20:54:21 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:application/javascript
ssdeep 49152:d+8Znw3RYczUTXpGbnjgs/LBUYDHoBWqkeRbBMgUeI+10SLKFvCyIwko3G/Ii9OR:i
TLSH T179F54E849194D43383DE1E13BECA2BAFD43B5CB3D98CA40B85547D9C68AC457D9ABCE0
Magika javascript
Reporter Tatamis
Tags:ContagiousInterview DPRK github js


Avatar
Tatamis
Contagious Interview (publicly tracked fake job-interview campaign). Observed statically in operator-controlled GitHub repositories, October 2026; nothing executed, no attacker host contacted. payload from operator repository rich-diamond2026/diamond (10/9), git blob 8454dbe68828e4b40d94dc081c2b42b235611471

Intelligence

File Origin
# of uploads :
1
# of downloads :
10
Origin country :
RO RO
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae82e8c3c74f575e61ceba4
Tags:
virus
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated repaired
Link:
https://www.filescan.io/uploads/6ae82e42fa55558d1af7f553/reports/fc82e23f-3251-43db-9a80-2bc759d5141e/overview
Verdict:
Malicious
File Type:
js
First seen:
2026-06-23T16:43:00Z UTC
Last seen:
2026-11-02T05:41:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/da8d7a294c004ee2ac8ef63a2b561eb1dfdea4315fc0c7babc76562bd8eff28f/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1996456
Signature
Multi AV Scanner detection for submitted file
Sigma detected: WScript or CScript Dropper
Behaviour
Behavior Graph:
Download SVG
Score:
95%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/da8d7a294c004ee2ac8ef63a2b561eb1dfdea4315fc0c7babc76562bd8eff28f
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Javascript T1059.007
Link:
https://app.malva.re/file/8b136a22819cbf1e565c1be8ba7e43cc
Gathering data
Threat name:
Script-JS.Trojan.PolinRider
Create hunting rule
Status:
Malicious
First seen:
2026-06-23 15:57:51 UTC
File Type:
Text (JavaScript)
AV detection:
9 of 36 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3kgxukkmabhofleo6y5cwvq6whp55jbrl7ampov4ozlcxwhp6khq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/da8d7a294c004ee2ac8ef63a2b561eb1dfdea4315fc0c7babc76562bd8eff28f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Java Script (JS) js da8d7a294c004ee2ac8ef63a2b561eb1dfdea4315fc0c7babc76562bd8eff28f

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/4050317/

Comments