Malicious
Malicious

441ea7ad8cdde00ac0c6a29e16fb6ddc

Share on LinkedIn
Print
JavaScript
MD5: 441ea7ad8cdde00ac0c6a29e16fb6ddc
Size: 3.42 MB
application/javascript
Ctrl + scroll to zoom · drag to pan

This sample is a 3.3 MB JavaScript for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 3 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a2f64de6b9ffc5bba40690b8b8e5ef8fd7d09b22b2766077b63d520622f4eaf9
MD5
441ea7ad8cdde00ac0c6a29e16fb6ddc
Verdict
Malicious
File type
JavaScript · 3.3 MB

Cite this report: https://app.malva.re/sha256/a2f64de6b9ffc5bba40690b8b8e5ef8fd7d09b22b2766077b63d520622f4eaf9

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
JavaScript file
Size
3.42 MB · 3,417,619 B
First seen
2026-10-28 11:00 · 2 days ago
Last seen
2026-10-28 11:00 · 2 days ago
Last analysis
2026-10-28 11:01 · 2 days ago
Hashes
MD5 441ea7ad8cdde00ac0c6a29e16fb6ddc Sha1 d45efc591cf9ad5d6d17d4847990b569767a91c0 Sha256 a2f64de6b9ffc5bba40690b8b8e5ef8fd7d09b22b2766077b63d520622f4eaf9 Sha384 99476052a87672d1a6ebe713b9a35a5626f024fe9cfc43467e8e522b853ad20735783754ca74ad2772e369eb36a30a8e Sha512 b553e06ebf718645dcb9a8dd20fe14f8595f3a8fc3be5a80cba063aac8e2dd925a617f4fc148c3729c17f347de33e60f156b1210e826cedd7a0894cc0ed55ac0 SSDeep 98304:G1plc95XVv2E4fz14eY4tSj93b80RrBSJz+1yFW/D0nxzxCQtEb5Wdvs1a3+a0vH:G1plc95XV27fR4h4tC9o0RrBSJz+1yF8 TLSH 01F5A18213C79572376AEB8D86399C31990A490324C2CB7239BCE71A353ED576F1C6E7

4 malicious · 4 files
JS441ea7ad8cdde00ac0c6a29e16fb6ddc
BIN441ea7ad8cdde00ac0c6a29e16fb6ddc.emulated
SH[Command #1]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:js~T1059.007>scr:bat>scr:ps1~T1027~T1059.001
Shape scr:js>scr:bat>scr:ps1
malicious 3 nodes

Command (emulation JS) #1 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (emulation JS) #2 UNKNWOWNmalicious
\NWTSWhuhuhuhuhuhuhuhuhuhuhu
Trace d'emulation JS (ordonnee) UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
ehuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙