MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef5a032ba5b84575f800c9836e13d3a8f0ed39e3363408709ebb0c5455720d24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ef5a032ba5b84575f800c9836e13d3a8f0ed39e3363408709ebb0c5455720d24
SHA3-384 hash:	b8a335556312a32c84131f75fbddeecfcd3127ab0698ced1a74c1147e6659747fa17bf49066c948abf970b31cd4602e4
SHA1 hash:	8d43ae2c0df8811a726a380c46d39f6951d16818
MD5 hash:	7565af9c9adde6727c9d270fa9679f38
humanhash:	pizza-purple-rugby-kitten
File name:	kaufvertrag_Mercedes-Benz_A250E_doc0325003209592.js
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	5'465'012 bytes
First seen:	2026-09-30 16:16:26 UTC
Last seen:	2026-10-14 15:30:19 UTC
File type:	js
MIME type:	text/plain
ssdeep	1536:f5QrfFjCkggfYaBpxegOKo+/W+7DBI0q7vZ8tese2OFOc3P6OVDmMWMUH+8ZrgMj:UQtpz0klCR
TLSH	T17F46498C560B892CCF44DB446671E73859662F72C4A6099C6ABB5E3BF8CDB97C039730
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	TomU
Tags:	js PureLogsStealer

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

196

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ace76d02e5d8a93d8150e24

Tags:

obfuscate xtreme virus

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

loader repaired

Link:

https://www.filescan.io/uploads/6abd360afdd297104adb2c3f/reports/26a9d074-c450-4680-89fa-c989ccb00ec4/overview

Hybrid Analysis GT:JS.Loader.31

Verdict:

Malicious

Labled as:

GT:JS.Loader.31

Link:

https://www.hybrid-analysis.com/sample/ef5a032ba5b84575f800c9836e13d3a8f0ed39e3363408709ebb0c5455720d24

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-09-30T02:55:00Z UTC

Last seen:

2026-10-02T14:02:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/ef5a032ba5b84575f800c9836e13d3a8f0ed39e3363408709ebb0c5455720d24/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB purelogs

Detection:

purelogs

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/ef5a032ba5b84575f800c9836e13d3a8f0ed39e3363408709ebb0c5455720d24/

ReversingLabs TitaniumCloud Script-JS.Trojan.Generic

Threat name:

Script-JS.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-09-30 09:27:06 UTC

File Type:

Binary

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=55nagk5fxbcxl6aazgbw4e6tvdyo2opdgy2aq4e6xmgfivlsbusa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

collection discovery execution

Link:

https://tria.ge/reports/260930-trfm6sxt6q/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Reads the TCP/IP host and domain name from the registry

System Time Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Badlisted process makes network request

Process spawned unexpected child process

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ef5a032ba5b8/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/ef5a032ba5b84575f800c9836e13d3a8f0ed39e3363408709ebb0c5455720d24