Malicious
JavaScript
MD5: 0cfcbc82b6f7771aa04c6de4eac89735
Size: 4.38 MB
application/javascript
Ctrl + scroll to zoom · drag to pan
This sample is a 4.2 MB JavaScript classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- ef5c98dd00ce50f98f97e24d38383d90e4512ac143e986cca83ed70adc2ce9bf
- MD5
- 0cfcbc82b6f7771aa04c6de4eac89735
- Verdict
- Malicious
- File type
- JavaScript · 4.2 MB
Cite this report: https://app.malva.re/sha256/ef5c98dd00ce50f98f97e24d38383d90e4512ac143e986cca83ed70adc2ce9bf
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
JavaScript file
Size
4.38 MB · 4,382,800 B
First seen
2026-10-26 07:45 · 5 hours ago
Last seen
2026-10-26 07:45 · 5 hours ago
Last analysis
2026-10-26 07:46 · 5 hours ago
Hashes
MD5
0cfcbc82b6f7771aa04c6de4eac89735
Sha1
aa7cc698588d4e02d6c1634747161174d78a50cc
Sha256
ef5c98dd00ce50f98f97e24d38383d90e4512ac143e986cca83ed70adc2ce9bf
Sha384
144aceec92832fc1d81496be4c014d87328d8f20f5a4ab35ee28d0cdc896d4e82432f738e3dc8f73c7d058c151a3a9b7
Sha512
ad07312dbbfa39fa03d8d5c9d28a662e822ce04671da9ec65299a405af27961bb3183d55a5f2afbe20bf4e948f2c7d1baa8f2587fe1ed6ff4ab065499c28d9a9
SSDeep
98304:9wrubKBhb79iLtctDSiwMfomrQ9tSbyuAKlQFB7fpsN9CCuPD7PVPDf1Qcu0TZu2:arubKBhb7oLetDSJMfomrQ9tSbyuAKlM
TLSH
A7164DC937C4513A33316F5D45E5A8209E0688F329A1CBA5B5FCF114BE7C90E5237ABA
4 malicious · 4 files
JS0cfcbc82b6f7771aa04c6de4eac89735T1027 · T1059.001 · T1059.007
BIN0cfcbc82b6f7771aa04c6de4eac89735.emulated
SH[Command #1]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:js~T1059.007>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:js>scr:bat>scr:ps1
malicious
3 nodes
Command (emulation JS) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (emulation JS) #2
UNKNWOWNmalicious
\MISSFhuhuhuhuhuhuhuhuhuhuhu
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
ehuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential