MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e84f09aa895b5927c1292b70a21a86ba0a2faf850dc64ce819b4f73dbd3aa7e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e84f09aa895b5927c1292b70a21a86ba0a2faf850dc64ce819b4f73dbd3aa7e2
SHA3-384 hash:	a7017c967e7ec153a367a8e1b738f016b0ee7ce0890580e1adc43d70aa6a28e555eb4e367d7cd8c30ce8cd37dc86fed9
SHA1 hash:	bdfbca5852187d8d677faa53ca5af95fc68f741b
MD5 hash:	57a28550e573ae8a4e798466670075f1
humanhash:	oscar-earth-hydrogen-orange
File name:	Document_2026050007.js
Download:	download sample
File size:	1'008'342 bytes
First seen:	2026-08-05 08:01:28 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:/wRw+RLhhYMY/RxYBqRhw+/UK2/7U226B/YMUNYSUKRU6MwC/LUKRYJ/hLYDX7Y2:/lCB91E1dtmbh3j
TLSH	T1DE25849F678FE91991A3362ECC2CD2B14FB140280667678C7D4BFED9062225C5C5FAE1
Magika	javascript
Reporter	abuse_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

147

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm fingerprint powershell repaired

Link:

https://www.filescan.io/uploads/6a72ee06701634634055078d/reports/2284a493-fda3-4c4a-9326-b6ee606f47eb/overview

Hybrid Analysis JS/LausivLoader.H trojan

Verdict:

Malicious

Labled as:

JS/LausivLoader.H trojan

Link:

https://www.hybrid-analysis.com/sample/e84f09aa895b5927c1292b70a21a86ba0a2faf850dc64ce819b4f73dbd3aa7e2

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-08-05T03:02:00Z UTC

Last seen:

2026-08-06T06:07:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/e84f09aa895b5927c1292b70a21a86ba0a2faf850dc64ce819b4f73dbd3aa7e2/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1952555

Signature

Creates processes via WMI

Detected large data written to user environment variables, potentially indicating payload staging for fileless execution

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

31%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/e84f09aa895b5927c1292b70a21a86ba0a2faf850dc64ce819b4f73dbd3aa7e2

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e84f09aa895b5927c1292b70a21a86ba0a2faf850dc64ce819b4f73dbd3aa7e2/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5bhqtkujlnmspqjjfnykegugxifc7l4fbxdez2azwt3t3pj2u7ra._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/260805-jw2q4asdra/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/e84f09aa895b5927c1292b70a21a86ba0a2faf850dc64ce819b4f73dbd3aa7e2