MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ed8b62831f8a9e20bb1d792e2eb3d7e5b4fc8daf96a4c972a11d548c15879d23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 9
| SHA256 hash: | ed8b62831f8a9e20bb1d792e2eb3d7e5b4fc8daf96a4c972a11d548c15879d23 |
|---|---|
| SHA3-384 hash: | 02b2ced7e877f992b0c8750801d508d00f26ebeeb529b719d7b0071d43545421446dd55cf598cd877b1323c5184fc946 |
| SHA1 hash: | 6691c5a38724666fe4dd0b08f93ae65afb57030f |
| MD5 hash: | 7e69cba6abdf56724393bfddc1d391a7 |
| humanhash: | paris-hot-twenty-fix |
| File name: | ed8b62831f8a9e20bb1d792e2eb3d7e5b4fc8daf96a4c972a11d548c15879d23 |
| Download: | download sample |
| File size: | 3'533'565 bytes |
| First seen: | 2026-11-01 20:53:15 UTC |
| Last seen: | Never |
| File type: |  js |
| MIME type: | application/javascript |
| ssdeep | 49152:g42HVcExz1+X9ZtxSI/EFq6hQQWx5hi+iULHu31qIMRzgw+kPGjFHn5EYmIg0nHj:4 |
| TLSH | T1D3F593C415E7E03395EE1A13BF496BADE17BA472A4CC690B81587D4C2CBE64FD5A2CC0 |
| Magika | javascript |
| Reporter |  Tatamis |
| Tags: | ContagiousInterview DPRK github js |
Tatamis
Contagious Interview (publicly tracked fake job-interview campaign). Observed statically in operator-controlled GitHub repositories, October 2026; nothing executed, no attacker host contacted. payload from operator repository vercelfor/vercel-ip (10/1), git blob a633ea12decdcef160fade1156ffa065d5862c9dIntelligence
File Origin
# of uploads :
1
# of downloads :
13
Origin country :
ROVendor Threat Intelligence
No detections
Verdict:
Clean
Score:
99.9%
Tags:
n/a
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated repaired
Verdict:
Malicious
File Type:
js
First seen:
2026-11-01T18:54:00Z UTC
Last seen:
2026-11-02T20:43:00Z UTC
Hits:
~10
Result
Threat name:
n/a
Detection:
suspicious
Classification:
n/a
Score:
22 / 100
Signature
Sigma detected: WScript or CScript Dropper
Behaviour
Behavior Graph:
Score:
84%
Verdict:
Malware
File Type:
SCRIPT
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Javascript T1059.007
Gathering data
Threat name:
Win32.Trojan.PolinRider
Status:
Suspicious
First seen:
2026-05-15 15:51:32 UTC
File Type:
Text (JavaScript)
AV detection:
9 of 23 (39.13%)
Threat level:
5/5
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
js ed8b62831f8a9e20bb1d792e2eb3d7e5b4fc8daf96a4c972a11d548c15879d23
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.