Malicious
Malicious

2f93dd073d53413b52f4af41c6c424fd

JavaScript
MD5: 2f93dd073d53413b52f4af41c6c424fd
Size: 3.19 MB
application/javascript
Ctrl + scroll to zoom · drag to pan

This sample is a 3 MB JavaScript classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
2e319b92201a119d5f73f0272a72fa8d20e6c6b303d03e7cfbeb10e08bef97e9
MD5
2f93dd073d53413b52f4af41c6c424fd
Verdict
Malicious
File type
JavaScript · 3 MB
MITRE ATT&CK
T1027T1059.001T1059.007

Cite this report: https://app.malva.re/sha256/2e319b92201a119d5f73f0272a72fa8d20e6c6b303d03e7cfbeb10e08bef97e9

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
JavaScript file
Size
3.19 MB · 3,193,870 B
Hashes
MD5 2f93dd073d53413b52f4af41c6c424fd Sha1 50b797b742b3d652c6dc458948b0f2695959bfe3 Sha256 2e319b92201a119d5f73f0272a72fa8d20e6c6b303d03e7cfbeb10e08bef97e9 Sha384 07513b2fa4c396f6f235a9d94a4a49dca571032886c17a8b91740b97cfebe643af10c1f0fc99a86bc52ba14f8bbe1364 Sha512 5912827c15d8c664c80c4fbc0b1cc9060d8cf17af63bc7af769737c1fe88377096a71d4bcb3c0cbc9ac5fa18d03bf265a88e436acb92617fa3f238eb9ba9266e SSDeep 98304:/Sp3hL68Hflk7DCWv3rneOPpe5W4uxY/laQ+qVH8NiUSOOmyfIc7TSPlv4jCbaxZ:S5W4Y39SOOfgYTOlv4jCbw TLSH 00E53C716018EB70A56EEA2CC527AB850FED3F0F12F47D3E36F8358463A2729255E452

4 malicious · 4 files
JS2f93dd073d53413b52f4af41c6c424fd
BIN2f93dd073d53413b52f4af41c6c424fd.emulated
SH[Command #1]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:js~T1059.007>scr:bat>scr:ps1~T1027~T1059.001
Shape scr:js>scr:bat>scr:ps1
malicious 3 nodes

Command (emulation JS) #1 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (emulation JS) #2 UNKNWOWNmalicious
\CXUHShuhuhuhuhuhuhuhuhuhuhu
Trace d'emulation JS (ordonnee) UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
ehuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

4 malicious · 4 files
JS2f93dd073d53413b52f4af41c6c424fd
BIN2f93dd073d53413b52f4af41c6c424fd.emulated
SH[Command #1]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
No malware configuration was found at this point.

Command (emulation JS) #1 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
2f93dd073d53413b52f4af41c6c424fd
Command (emulation JS) #2 UNKNWOWNmalicious
\CXUHShuhuhuhuhuhuhuhuhuhuhu
2f93dd073d53413b52f4af41c6c424fd
Trace d'emulation JS (ordonnee) UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
2f93dd073d53413b52f4af41c6c424fd
Deobfuscated PowerShell UNKNWOWNmalicious
ehuhuhuhu
2f93dd073d53413b52f4af41c6c424fd › 2f93dd073d53413b52f4af41c6c424fd.emulated › [Command #1] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙