MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfce1a7c7a16a39ba7bccc696f2dd6de7a33199a103d442ba09bcc2e156bebde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dfce1a7c7a16a39ba7bccc696f2dd6de7a33199a103d442ba09bcc2e156bebde
SHA3-384 hash:	7b0e24705b8e82fd7eee03f87942ef387e06597be12f50e4a7a37fd653e481ee23f83b10f303db2fb81b7fab0875121a
SHA1 hash:	9043414fb82c98381d7ec10fc0afcefb1f0f4ac1
MD5 hash:	0690bc49b7ba19b7b1b4af04b7d00b37
humanhash:	cat-white-mexico-montana
File name:	PAGO F-7059.js
Download:	download sample
File size:	1'650'227 bytes
First seen:	2026-10-08 19:25:58 UTC
Last seen:	Never
File type:	js
MIME type:	application/javascript
ssdeep	6144:zYrrrxtpAk8ubOX3zLBRhBofsdEcg8YEktfKcSMeBlaUwSpL+f1V8TiMmxdH1LEg:iVjAkrOpjKZ5BlSkV5DZLY4mgirq
TLSH	T138757BF11EE56D8515B84227C3D0E49D0D623F8069AEDEA41034F1B7A7F8650BFA84AF
Magika	javascript
Reporter	abuse_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

152

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

encrypted obfuscated repaired

Link:

https://www.filescan.io/uploads/6ac7ee5e969f6f5907ee1d6f/reports/55447d8c-8161-40c4-a167-718e3082e147/overview

Hybrid Analysis JS/Agent.FEG

Verdict:

Suspicious

Labled as:

JS/Agent.FEG

Link:

https://www.hybrid-analysis.com/sample/dfce1a7c7a16a39ba7bccc696f2dd6de7a33199a103d442ba09bcc2e156bebde

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-10-08T15:20:00Z UTC

Last seen:

2026-10-09T17:32:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/dfce1a7c7a16a39ba7bccc696f2dd6de7a33199a103d442ba09bcc2e156bebde/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1984490

Signature

Found potential dummy code loops (likely to delay analysis)

Sigma detected: WScript or CScript Dropper

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/dfce1a7c7a16a39ba7bccc696f2dd6de7a33199a103d442ba09bcc2e156bebde

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dfce1a7c7a16a39ba7bccc696f2dd6de7a33199a103d442ba09bcc2e156bebde/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=37hbu7d2c2rzxj54zruw6low3z5dggm2ca6uik5atpgc4fll5ppa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/261008-x5ngqavv7m/

Behaviour

Command and Scripting Interpreter: JavaScript

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.07

Link:

https://yomi.yoroi.company/submissions/dfce1a7c7a16a39ba7bccc696f2dd6de7a33199a103d442ba09bcc2e156bebde