156eda697a81a7d3ceea0aa353da0d40

JavaScript

MD5: 156eda697a81a7d3ceea0aa353da0d40

Size: 1.92 MB

application/javascript

Ctrl + scroll to zoom · drag to pan

This sample is a 1.8 MB JavaScript classified as malicious by Malva.RE. Static analysis extracted 1 embedded or derived file. It matches 5 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.007 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: 69a2a618b9bfed2daf3707804947cfcbbfc8f28e97c74b46f275df664f186e52
MD5: 156eda697a81a7d3ceea0aa353da0d40
Verdict: Malicious
File type: JavaScript · 1.8 MB
MITRE ATT&CK: T1027 T1059.007 T1105

Cite this report: https://app.malva.re/sha256/69a2a618b9bfed2daf3707804947cfcbbfc8f28e97c74b46f275df664f186e52

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

JavaScript file

Size

1.92 MB · 1,923,132 B

First seen

2026-10-26 13:00 · 2 hours ago

Last seen

2026-10-26 13:00 · 2 hours ago

Last analysis

2026-10-26 13:00 · 2 hours ago

Hashes

MD5 156eda697a81a7d3ceea0aa353da0d40 Sha1 d54df604e8da6d9921014dd267bef204e39f79e4 Sha256 69a2a618b9bfed2daf3707804947cfcbbfc8f28e97c74b46f275df664f186e52 Sha384 8f0f0122b854dfa2bb796e0b186b183eb30345444cc8d503a720ece9aff9e88914e66b1c43dc35af6e210e25cc498f91 Sha512 72604d2243e2dc8966dd1ce97849b768e7dfc6d33d23bbb758a0a05c648995c1cd4b33b5c986fa58e1b301077a1aaabcc056e056430f9dd93a0a023e9795caf0 SSDeep 49152:fb1j5kb1Iy2D7xBhHsPJfBX2pkfD3Pnrx4MgHV+Efz3f3oCLOdQMR9x26Wv6Y6tv:fb1j5kb1ADVBhHsRfN2psD3Pnr2MgHMP TLSH 1D95A42BC3364849357B53C8C29856958C48E25B84A06DD36DFFFCFAA6E4E6650F4E30

2 malicious · 2 files

JS156eda697a81a7d3ceea0aa353da0d40

BIN156eda697a81a7d3ceea0aa353da0d40.emulated

JS[Stage #1].js

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:js~T1027~T1059.007~T1105

Shape scr:js

malicious 1 nodes

Command (emulation JS) #1 UNKNWOWNmalicious

"\XLAYhuhuhuhuhuhuhuhuhuhuhu

Dropped path (emulation JS) #1 PATHmalicious

\XLAYGhuhuhuhuhuhuhuhuhuhuhu

Dropped path (emulation JS) #2 PATHmalicious

\XLAYGhuhuhuhuhuhuhuhuhuhuhu

Dropped path (emulation JS) #3 PATHmalicious

\XLAYGhuhuhuhuhuhuhuhuhuhuhu

Trace d'emulation JS (ordonnee) UNKNWOWNmalicious

#? evhuhuhuhuhuhuhuhuhuhuhu

Command (emulation JS) #1 UNKNWOWNmalicious

"\VTAKhuhuhuhuhuhuhuhuhuhuhu

Dropped path (emulation JS) #1 PATHmalicious

\VTAKXhuhuhuhuhuhuhuhuhuhuhu

Dropped path (emulation JS) #2 PATHmalicious

\VTAKXhuhuhuhuhuhuhuhuhuhuhu

Dropped path (emulation JS) #3 PATHmalicious

\VTAKXhuhuhuhuhuhuhuhuhuhuhu

Trace d'emulation JS (ordonnee) UNKNWOWNmalicious

#? nehuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

2 malicious · 2 files

JS156eda697a81a7d3ceea0aa353da0d40

BIN156eda697a81a7d3ceea0aa353da0d40.emulated

JS[Stage #1].js

No malware configuration was found at this point.

Command (emulation JS) #1 UNKNWOWNmalicious

"\XLAYhuhuhuhuhuhuhuhuhuhuhu