MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db4c234a950279b3fee6e07157fd6c6e9ff082f8a72211749a0a3eb84a3bc0f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	db4c234a950279b3fee6e07157fd6c6e9ff082f8a72211749a0a3eb84a3bc0f5
SHA3-384 hash:	070d3a8e47df3a42be50239ede8f7fd971c54ae350baf7157e08a67c838068586cdf82995e2163ef303d4b9965b4a2fa
SHA1 hash:	d8a7362cd4eb787512fb79618bb2d40ac52d772e
MD5 hash:	17de57585f9840d830a8aa989f6ea02b
humanhash:	oklahoma-carolina-william-gee
File name:	REQ For Payment Invoice FER480120002600086230-800119_pdf.js
Download:	download sample
File size:	993'354 bytes
First seen:	2026-05-26 15:13:03 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:szzXUtuyELiPwARCAYaPcubd1JRY+KVHRtZnBwzjEhUxVhiK9kBw:GXZiPwA0HKcaYTRwKq5P
Threatray	80 similar samples on MalwareBazaar
TLSH	T10725513DDAD5001DB0B29A14BDB5040FA4677B522A3D894F12C9128F4F7390DBBADB6E
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	javascript
Reporter	lowmal3
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

139

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.DownLoader.10105.27126.11826.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a15b89c5b1db29f5a48100d

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 encrypted lolbin masquerade obfuscated repaired wscript

Link:

https://www.filescan.io/uploads/6a15b89546e44aecc0bd4e3e/reports/c3bbc8d6-37ed-457b-a721-4c5900558a7c/overview

Hybrid Analysis JS/Agent.UQA trojan

Verdict:

Malicious

Labled as:

JS/Agent.UQA trojan

Link:

https://www.hybrid-analysis.com/sample/db4c234a950279b3fee6e07157fd6c6e9ff082f8a72211749a0a3eb84a3bc0f5

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-05-26T04:53:00Z UTC

Last seen:

2026-05-28T13:33:00Z UTC

Hits:

~1000

Detections:

HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.Generic

Link:

https://opentip.kaspersky.com/db4c234a950279b3fee6e07157fd6c6e9ff082f8a72211749a0a3eb84a3bc0f5/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1918774

Signature

Antivirus detection for URL or domain

Creates a thread in another existing process (thread injection)

Creates an undocumented autostart registry key

Injects a PE file into a foreign processes

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Powershell scriptblock execution from environment variable

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

61%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/db4c234a950279b3fee6e07157fd6c6e9ff082f8a72211749a0a3eb84a3bc0f5

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/db4c234a950279b3fee6e07157fd6c6e9ff082f8a72211749a0a3eb84a3bc0f5/

Neiki Trojan.Script

Verdict:

Malicious

Threat:

Trojan.Script

Link:

https://tip.neiki.dev/file/db4c234a950279b3fee6e07157fd6c6e9ff082f8a72211749a0a3eb84a3bc0f5

ReversingLabs TitaniumCloud Win32.Trojan.Kepavll

Threat name:

Win32.Trojan.Kepavll

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-26 07:29:39 UTC

File Type:

Text (JavaScript)

AV detection:

13 of 38 (34.21%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3ngcgsuvaj43h7xg4byvp7lmn2p7baxyu4rbc5e2bi7lqsr3yd2q._file

Threatray purecrypter stubrunner

Verdict:

malicious

Label(s):

purecrypter

Alert

Create hunting rule

stubrunner

Alert

Create hunting rule

Similar samples:

2abef9c410a3a2675ac87b87a6c0afcc6e7ac3eb4ea79d78ed4fd12ae0b6f934

500592a2cfd2536eeac2bd102bd56bb2c5f5fb4aff3c15239c6b9b8113c5f2d7

6061119190545cf3c94f712fd5fda321f54b106bbdb9cf08d64b872dab5fa756

61d424c2e3c5d8db831dc1cc697dfa4a94ebe86e008c24c31bfd34641815273a

c8336e84c4a44b42ffc0f6cb57cf573b42cb46fa4ef9e553a9bb398dccee0ca2

d218c6a408aac1ed96d166aa142c4535726af2767bbf473859df0e1091b9be81

error

+ 70 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection discovery execution persistence

Link:

https://tria.ge/reports/260526-sly2wses7p/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Time Discovery

Drops file in Windows directory

Accesses Microsoft Outlook profiles

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/db4c234a950279b3fee6e07157fd6c6e9ff082f8a72211749a0a3eb84a3bc0f5