MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8ff24c83362ce9367f8be0a45aba7651cddfcaa5a776e0f481ceeeef8960a5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f8ff24c83362ce9367f8be0a45aba7651cddfcaa5a776e0f481ceeeef8960a5a
SHA3-384 hash:	f5169f0c8e731012f99f7560c80be9ba0ea39649f822ca72d5457e60d0a18814f8c79e0f96d078a6f3d51ff4a1a8ef70
SHA1 hash:	349e1009e1d7b1958d2e98e9921321463b28d10d
MD5 hash:	81760e09cb23f94fe633141d8ee6e44d
humanhash:	uniform-april-tennessee-jig
File name:	Factura 0432.js
Download:	download sample
File size:	177'113 bytes
First seen:	2026-09-07 17:40:53 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:Qj3LzJEgzJEg0j37j3LzJEgzJEg0j37j3LzJEgzJEg0j37j3LzJEgzJEg0j37j30:dnononononon6nonononononY
TLSH	T18904B3170B3C273BAFA503611529C10963F88ED5EC769F186A2DC8B86D78E1F16A45FC
Magika	javascript
Reporter	abuse_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

121

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

downloader evasive masquerade obfuscated repaired

Link:

https://www.filescan.io/uploads/6a9ef74e2d00e594ed04bdac/reports/c41acb66-3714-4e81-8f0b-a083014337b8/overview

Hybrid Analysis JS/Obfuscated.CN trojan

Verdict:

Suspicious

Labled as:

JS/Obfuscated.CN trojan

Link:

https://www.hybrid-analysis.com/sample/f8ff24c83362ce9367f8be0a45aba7651cddfcaa5a776e0f481ceeeef8960a5a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-09-07T08:34:00Z UTC

Last seen:

2026-09-09T13:09:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/f8ff24c83362ce9367f8be0a45aba7651cddfcaa5a776e0f481ceeeef8960a5a/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1969479

Signature

JavaScript file contains suspicious strings

JavaScript source code contains functionality to generate code involving a shell, file or stream

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

92%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f8ff24c83362ce9367f8be0a45aba7651cddfcaa5a776e0f481ceeeef8960a5a

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f8ff24c83362ce9367f8be0a45aba7651cddfcaa5a776e0f481ceeeef8960a5a/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7d7sjsbtmlhjgz7yxyfelk5hmuon37fklj3w4d2idtxo56ewbjna._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260907-v9mpwazxdz/

Behaviour

Command and Scripting Interpreter: JavaScript

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f8ff24c83362ce9367f8be0a45aba7651cddfcaa5a776e0f481ceeeef8960a5a