Malicious
JavaScript
MD5: 26916162a3a69a2619177e2cedac6e77
Size: 1.81 MB
application/javascript
Ctrl + scroll to zoom · drag to pan
This sample is a 1.7 MB JavaScript classified as malicious by Malva.RE. Static analysis extracted 1 embedded or derived file. It matches 5 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.007 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- b3f9e41afc1b73ec4c9e218aee6bfe65a0181c933dffe86f2e207c759c7a4e5d
- MD5
- 26916162a3a69a2619177e2cedac6e77
- Verdict
- Malicious
- File type
- JavaScript · 1.7 MB
Cite this report: https://app.malva.re/sha256/b3f9e41afc1b73ec4c9e218aee6bfe65a0181c933dffe86f2e207c759c7a4e5d
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
JavaScript file
Size
1.81 MB · 1,813,071 B
First seen
2026-10-26 07:45 · 5 hours ago
Last seen
2026-10-26 07:45 · 5 hours ago
Last analysis
2026-10-26 07:45 · 5 hours ago
Hashes
MD5
26916162a3a69a2619177e2cedac6e77
Sha1
7a3e220ed37471d4a0bd7a3d5b2bfef1103725d1
Sha256
b3f9e41afc1b73ec4c9e218aee6bfe65a0181c933dffe86f2e207c759c7a4e5d
Sha384
65dd95d61eed18fc794d88e83b9884ccbf7ac60012ecc75129afb4e50a6c5ce467bd2c5fec66365a3187a547135ca393
Sha512
6fab2460e43514f2d5c482eba05dd87c7b9eb9a83895e6be91d950912bf889a4ccba95b3de847c024f41a3e31686dda65308bc55f2a21ed483f7b97cb29a2358
SSDeep
6144:k1/KB8HyI5Ix3FiUv7gfBdu2xTHd1lqBV/jfaMdQlbRgsq+uiok3KcIM2JMLnFCj:2/KSHL5G4KMnufjVkuil33ITUq
TLSH
40852CA4C09CE0CC2E5955FEAD42D9E4361E0CF9ADEFE6640E2D94B0D8BC174864ACF5
2 malicious · 2 files
JS26916162a3a69a2619177e2cedac6e77T1027 · T1105 · T1059.007
BIN26916162a3a69a2619177e2cedac6e77.emulated
JS[Stage #1].jsT1105 · T1059.007
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:js~T1027~T1059.007~T1105
Shape
scr:js
malicious
1 nodes
Command (emulation JS) #1
UNKNWOWNmalicious
"\KEYPhuhuhuhuhuhuhuhuhuhuhu
Dropped path (emulation JS) #1
PATHmalicious
\KEYPHhuhuhuhuhuhuhuhuhuhuhu
Dropped path (emulation JS) #2
PATHmalicious
\KEYPHhuhuhuhuhuhuhuhuhuhuhu
Dropped path (emulation JS) #3
PATHmalicious
\KEYPHhuhuhuhuhuhuhuhuhuhuhu
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? evhuhuhuhuhuhuhuhuhuhuhu
Command (emulation JS) #1
UNKNWOWNmalicious
"\HFNYhuhuhuhuhuhuhuhuhuhuhu
Dropped path (emulation JS) #1
PATHmalicious
\HFNYHhuhuhuhuhuhuhuhuhuhuhu
Dropped path (emulation JS) #2
PATHmalicious
\HFNYHhuhuhuhuhuhuhuhuhuhuhu
Dropped path (emulation JS) #3
PATHmalicious
\HFNYHhuhuhuhuhuhuhuhuhuhuhu
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential