Suspect
49d8204af7d4ad39086f0b148b6668df
JavaScript
MD5: 49d8204af7d4ad39086f0b148b6668df
Size: 4.93 MB
application/javascript
This sample is a 4.7 MB JavaScript for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 15 embedded or derived files. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- e6a0e9ad743a924c8c746e4dec8e0780843342ffd2b3b0024e25cd19495cfbee
- MD5
- 49d8204af7d4ad39086f0b148b6668df
- Verdict
- Inconclusive
- File type
- JavaScript · 4.7 MB
- MITRE ATT&CK
- T1059.007
Cite this report: https://app.malva.re/sha256/e6a0e9ad743a924c8c746e4dec8e0780843342ffd2b3b0024e25cd19495cfbee
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
JavaScript (reclassé : grammaire non-VBScript)
Size
4.93 MB · 4,930,473 B
First seen
2026-10-04 03:45 · 27 days ago
Last seen
2026-10-04 03:45 · 27 days ago
Last analysis
2026-10-04 03:45 · 27 days ago
Hashes
MD5
49d8204af7d4ad39086f0b148b6668df
Sha1
e8ad35b9c9786748b402c1c41cea457926372039
Sha256
e6a0e9ad743a924c8c746e4dec8e0780843342ffd2b3b0024e25cd19495cfbee
Sha384
15cc531da6166b328c3d037ef142f31c8a8e8fd187bae5c104e997472422c7b03a68bf2a7a1426c22444c5b6acf02c3a
Sha512
cfd8f74efc3dc0a9865c7f2bcc22d1aabccfff23c6c634494300c68047f1c95dc5e775086a5d627f5aae3a55ac2f6044e8233247f650d3c3a07a5e4bb69d2d16
SSDeep
98304:ZcfPU9e+2hZJmnqHOg0Pr2hZTLc5JF6Tybp6zIIGTbPA2hNet9f/T1X:ePU9uig0PiTw5JFtbp6zIZvPK/TB
TLSH
C03633C39BF3DBB0F5C105B89D26007674861CBD2828385A7F9E6DCE47AB6517B86381
Detection
PeID
Borland Delphi 4.0Inno Setup Module [SFX] - v.5.x - 6.0 Borland Delphi - ASL Microsoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon
16 files
JS49d8204af7d4ad39086f0b148b6668dfT1059.007
Structure
JSOverlay_a0020313.binT1059.007
BINResources
BINRT_ICON
BINID:0001
BINID:1043
BINID:0002
BINID:1043
BINID:0003
BINID:1043
BINID:0004
BINID:1043
BINRT_STRING
BINID:0FF9
BINID:0
BINID:0FFA
BINID:0
BINID:0FFB
BINID:0
BINID:0FFD
BINID:0
BINID:0FFE
BINID:0
BINID:0FFF
BINID:0
BINRT_RCDATA
BINID:2B67
BINID:0
BINRT_GROUP_CURSOR4
BINID:0000
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe~T1059.007>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
technique3 nodes
Path
pe:exe~T1059.007>scr:js~T1059.007
Shape
pe:exe>scr:js
technique2 nodes
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_a0020313.bin (4872105 bytes) |
16 files
JS49d8204af7d4ad39086f0b148b6668dfT1059.007
Structure
JSOverlay_a0020313.binT1059.007
BINResources
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account