Malicious
3e145a5d3c7d6e66cbf4e7981960db57
JavaScript
MD5: 3e145a5d3c7d6e66cbf4e7981960db57
Size: 19.67 KB
application/javascript
Ctrl + scroll to zoom · drag to pan
This sample is a 19.2 KB JavaScript classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001, T1059.007 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 015dc287064d35aaf85c63bfd896f4041f720b4e1733c5713fc9fba98fe6eb79
- MD5
- 3e145a5d3c7d6e66cbf4e7981960db57
- Verdict
- Malicious
- File type
- JavaScript · 19.2 KB
Cite this report: https://app.malva.re/sha256/015dc287064d35aaf85c63bfd896f4041f720b4e1733c5713fc9fba98fe6eb79
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
JavaScript file
Size
19.67 KB · 19,665 B
First seen
2026-10-27 04:00 · 4 hours ago
Last seen
2026-10-27 04:00 · 4 hours ago
Last analysis
2026-10-27 04:00 · 4 hours ago
Hashes
MD5
3e145a5d3c7d6e66cbf4e7981960db57
Sha1
2550c964f564f6235298acb0011c75e108f4c486
Sha256
015dc287064d35aaf85c63bfd896f4041f720b4e1733c5713fc9fba98fe6eb79
Sha384
91c4c2864005e866a5424bd6134e7ee182c6be80c329ab1a4c666cfc549dc109cde2d9e876434f2595dcbdd58f0eda0b
Sha512
d44a8cb728ffcae39dd0c848d962a83c8b9ff0b73b6f2383f0b9c4c8500dd4865583d811de1b5506e1ff68ddf42940327a6d804dcf41e1e66c00664810f135e9
SSDeep
384:oCukXwZrHbc/CukXwZrHbc/CukXwZrHbcZw3P6jgZvDZLaCukXwZrHbc/CukXwZk:oVKwZr7c/VKwZr7c/VKwZr7cZw3yjg96
TLSH
B89263A464E4D7D8142BA1E352B5B751D34E089FB1057BDDE04C6FCCB8AEE8866A730C
4 malicious · 4 files
JS3e145a5d3c7d6e66cbf4e7981960db57T1027 · T1105 · T1059.001
BIN3e145a5d3c7d6e66cbf4e7981960db57.emulated
SH[Command #1]T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:js~T1059.007~T1105>scr:bat>scr:ps1~T1027~T1059.001~T1105
Shape
scr:js>scr:bat>scr:ps1
malicious
3 nodes
Command (emulation JS) #1
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Command (emulation JS) #2
UNKNWOWNmalicious
"huhuhuhu
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
(New-Ohuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential4 malicious · 4 files
JS3e145a5d3c7d6e66cbf4e7981960db57T1027 · T1105 · T1059.001
BIN3e145a5d3c7d6e66cbf4e7981960db57.emulated
SH[Command #1]T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
No malware configuration was found at this point.
Command (emulation JS) #1
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
3e145a5d3c7d6e66cbf4e7981960db57
Command (emulation JS) #2
UNKNWOWNmalicious
"huhuhuhu
3e145a5d3c7d6e66cbf4e7981960db57
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
3e145a5d3c7d6e66cbf4e7981960db57
Deobfuscated PowerShell
UNKNWOWNmalicious
(New-Ohuhuhuhuhuhuhuhuhuhuhu
3e145a5d3c7d6e66cbf4e7981960db57 › 3e145a5d3c7d6e66cbf4e7981960db57.emulated › [Command #1] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account