MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dca32c0ed32ad209f42bc4c59ffbdca42f5913f9d2248ee18b4473df9916a525. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dca32c0ed32ad209f42bc4c59ffbdca42f5913f9d2248ee18b4473df9916a525
SHA3-384 hash:	fe20cd1e8e141ce6821f54b5b1089aee189865b12bd01d84572be557c234809e7b00f113bbf2993d5b3a31c810efb802
SHA1 hash:	a6e179ff19c836b7f90fc57e94701082242cea84
MD5 hash:	32b36aecd09aba71a0e558c20cd40fb1
humanhash:	magazine-seven-angel-juliet
File name:	RFQ-05-10-26-signed_pdf.js
Download:	download sample
File size:	818'054 bytes
First seen:	2026-10-05 09:35:17 UTC
Last seen:	2026-10-05 10:52:11 UTC
File type:	js
MIME type:	text/plain
ssdeep	192:eC2tT8tPgIqYxXIDYfvoPyZsa09xSCsIQP8wcsnyP7wCNUJSO2K6ZkOc8Pi8xGwa:H
TLSH	T13405187682FD2F7DC42B5619CE7A3C0C98F054A10A4EF47AED3BA4C5D47CADA66A0190
Magika	javascript
Reporter	abuse_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

164

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 encrypted evasive masquerade obfuscated reconnaissance repaired

Link:

https://www.filescan.io/uploads/6ac36f6c1c1a3e0f6e93c272/reports/4f7c87e8-b82f-46b3-a14d-0fcb295605a8/overview

Hybrid Analysis GT:JS.Acsogenixx.6354

Verdict:

Malicious

Labled as:

GT:JS.Acsogenixx.6354

Link:

https://www.hybrid-analysis.com/sample/dca32c0ed32ad209f42bc4c59ffbdca42f5913f9d2248ee18b4473df9916a525

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2026-10-05T05:39:00Z UTC

Last seen:

2026-10-07T07:38:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/dca32c0ed32ad209f42bc4c59ffbdca42f5913f9d2248ee18b4473df9916a525/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1982307

Signature

Benign windows process drops PE files

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

20%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/dca32c0ed32ad209f42bc4c59ffbdca42f5913f9d2248ee18b4473df9916a525

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dca32c0ed32ad209f42bc4c59ffbdca42f5913f9d2248ee18b4473df9916a525/

ReversingLabs TitaniumCloud Script-JS.Trojan.Acsogenixx

Threat name:

Script-JS.Trojan.Acsogenixx

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-05 09:36:28 UTC

File Type:

Text (JavaScript)

AV detection:

10 of 38 (26.32%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3srsydwtfljat5blytcz7664uqxvse7z2isi5ymlirz57giwuusq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261005-lmkgkatsa1/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

Checks computer location settings

Executes dropped EXE

Badlisted process makes network request

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.