🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f10f34bdf2c7c49a54fe1acd8b51f1ca6ef23705f56b4f3fe72ba0714a67a5cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f10f34bdf2c7c49a54fe1acd8b51f1ca6ef23705f56b4f3fe72ba0714a67a5cc
SHA3-384 hash: 9a3c51b170acf33d1941d8b3a87e03261d07dd1521f2943b8288b31064cc5dec528972e85d0e54cdcbbf39cffa0b8f4b
SHA1 hash: ee9cf9fa668958a9d6355b66460145ff2318ddec
MD5 hash: af66af67d421f4b56d5e6cd9747a8db0
humanhash: burger-nineteen-equal-happy
File name:rateconfirmation194423.js
Download: download sample
File size:494'601 bytes
First seen:2026-09-14 20:30:52 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 1536:t0w2Y89kFt54e0d29Z9Mdffp/aa1NVNR3joNdPlvDBDp/H9TJJ8McqBOrAWAvEin:DlWr3ufrR+wirnPF73JeOcRj
TLSH T103B4A1C763940BAEB7848CDD8498611B54B1F1993C3A16B8FFC296D7B83EDD1A521B30
Magika javascript
Reporter Anonymous
Tags:js

Intelligence

File Origin
# of uploads :
1
# of downloads :
156
Origin country :
US US
Vendor Threat Intelligence
No detections
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
encrypted obfuscated repaired
Link:
https://www.filescan.io/uploads/6aa8598d32b48445d67841e1/reports/b640ae88-5e18-4872-8e11-c9a34ed25e24/overview
Verdict:
Suspicious
Labled as:
SVM:TrojanDownloader/JS.MalBehav.gen
Link:
https://www.hybrid-analysis.com/sample/f10f34bdf2c7c49a54fe1acd8b51f1ca6ef23705f56b4f3fe72ba0714a67a5cc
Score:
68%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/f10f34bdf2c7c49a54fe1acd8b51f1ca6ef23705f56b4f3fe72ba0714a67a5cc
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f10f34bdf2c7c49a54fe1acd8b51f1ca6ef23705f56b4f3fe72ba0714a67a5cc/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ehtjppsy7cjuvh6dlgywuprzjxpenyf6vvu6p7hfoqhcsthuxga._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery execution persistence privilege_escalation
Link:
https://tria.ge/reports/260914-zarl1avtfv/
Behaviour
Checks processor information in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Executes a command shell one-liner
Discovers running processes
Obfuscated Files or Information: Command Obfuscation
Event Triggered Execution: Component Object Model Hijacking
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/f10f34bdf2c7c49a54fe1acd8b51f1ca6ef23705f56b4f3fe72ba0714a67a5cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments