MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f28b648214c7c333768c792ccd6ee741cf7bade528aa6367acd645e1ce195e11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f28b648214c7c333768c792ccd6ee741cf7bade528aa6367acd645e1ce195e11
SHA3-384 hash:	b1702506dc389f6b24ef93defc3701bcfd474a07605f801fcf283b2891f6cd98a6ac8da2fe90067d9a2978fb430d88dd
SHA1 hash:	824f646e62bfbb41013285e6e013ccfc58c76720
MD5 hash:	b579f26caa603c2270ad5c0823567dc0
humanhash:	romeo-oxygen-lion-fish
File name:	REQ_For_Payment_Invoice__FER48012000266666230-7134009_pdf.js
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	798'044 bytes
First seen:	2026-06-12 21:55:43 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:OpyriYBZ9c7/YSNx/PiCxspM8i+iPyCM1tRxnr2CoYLYW9Iw/RbEQA55amMnPhdF:UXy
TLSH	T1B805D53DCE14412FE872C519C899855FF882659B222CED4794CB2F5FAE7288277C325E
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	TomU
Tags:	js PureLogsStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

156

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a2c7fdc34eaf30d8ce55307

Tags:

agenttesla stration virus shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

conhost masquerade obfuscated powershell repaired

Link:

https://www.filescan.io/uploads/6a2c80a5554e843ff869d700/reports/ad704fb3-c270-40f5-a174-03ae690bfa37/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f28b648214c7c333768c792ccd6ee741cf7bade528aa6367acd645e1ce195e11

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-09T20:33:00Z UTC

Last seen:

2026-06-14T20:10:00Z UTC

Hits:

~1000

Detections:

PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/f28b648214c7c333768c792ccd6ee741cf7bade528aa6367acd645e1ce195e11/results?tab=lookup

Nucleon Malprob Susipicious

Score:

64%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/f28b648214c7c333768c792ccd6ee741cf7bade528aa6367acd645e1ce195e11

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f28b648214c7c333768c792ccd6ee741cf7bade528aa6367acd645e1ce195e11/

Neiki Trojan.Win32

Verdict:

Malicious

Threat:

Trojan.Win32

Link:

https://tip.neiki.dev/file/f28b648214c7c333768c792ccd6ee741cf7bade528aa6367acd645e1ce195e11

ReversingLabs TitaniumCloud Script-JS.Packed.Generic

Threat name:

Script-JS.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-06-10 00:58:48 UTC

File Type:

Text (JavaScript)

AV detection:

11 of 24 (45.83%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6kfwjaquy7btg5umpewm23xhihhxxlpffcvggz5m2zc6dtqzlyiq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection defense_evasion discovery execution persistence

Link:

https://tria.ge/reports/260612-1vlrxscv5z/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Time Discovery

Drops file in Windows directory

Accesses Microsoft Outlook profiles

Hide Artifacts: Hidden Window

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f28b648214c7c333768c792ccd6ee741cf7bade528aa6367acd645e1ce195e11