Ctrl + scroll to zoom · drag to pan

This sample is a 12.9 KB JavaScript. Malva.RE parsed it statically and found no known malware family, configuration or malicious signature. Static analysis extracted 3 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001, T1059.007 and T1105. Static analysis cannot prove a file is harmless: an unknown or heavily packed threat can go undetected. The file was parsed and decompiled, never executed.

SHA256
b56f0e17c790eceba2dc707d9f983bb8caf265a68205b0eb2cca7410e4fc4a64
MD5
517032702d6fdebe56eeeab06f50fd68
Verdict
No known threat found
File type
JavaScript · 12.9 KB

Cite this report: https://app.malva.re/sha256/b56f0e17c790eceba2dc707d9f983bb8caf265a68205b0eb2cca7410e4fc4a64

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
JavaScript file
Size
13.16 KB · 13,164 B
First seen
2026-11-02 13:45 · yesterday
Last seen
2026-11-02 13:45 · yesterday
Last analysis
2026-11-02 13:46 · yesterday
Hashes
MD5 517032702d6fdebe56eeeab06f50fd68 Sha1 9e879ae26e3aa840f1df6afad8086b70ad807b26 Sha256 b56f0e17c790eceba2dc707d9f983bb8caf265a68205b0eb2cca7410e4fc4a64 Sha384 9895f2ecd36cd738220950cddb1e653028a1104b112c8b8dfa850afe295706e51f0ccdc32e294f9c79ede555e24dc5ee Sha512 815467d420e78e4d5c7301d15aac4ba15c7e004202f6b3363a53280b468bca6cde7af9b7d3d074f83b9a5f13063ba165251d51ee1ef884575b0574e46d28d5b1 SSDeep 96:yHYVPXTkmnHYVPXTkmnHYVPXTkm6k9jqTNh7fHYVPXTkmnHYVPXTkmnHYVPXTkmL:dVLkxVLkxVLk9BTNh7wVLkxVLkxVLkC TLSH C942BBC679CCD76528BB72878130B7585B6DCDAAF110B1E7372C69CF3C4298A42A631D

4 malicious · 4 files
JS517032702d6fdebe56eeeab06f50fd68
BIN517032702d6fdebe56eeeab06f50fd68.emulated
SH[Command #1]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:js~T1059.007~T1105>scr:bat>scr:ps1~T1027~T1059.001~T1105
Shape scr:js>scr:bat>scr:ps1
malicious 3 nodes

Command (emulation JS) #1 UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Command (emulation JS) #2 UNKNWOWNmalicious
"huhuhuhu
Trace d'emulation JS (ordonnee) UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
(New-Ohuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

4 malicious · 4 files
JS517032702d6fdebe56eeeab06f50fd68
BIN517032702d6fdebe56eeeab06f50fd68.emulated
SH[Command #1]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
No malware configuration was found at this point.

Command (emulation JS) #1 UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
517032702d6fdebe56eeeab06f50fd68
Command (emulation JS) #2 UNKNWOWNmalicious
"huhuhuhu
517032702d6fdebe56eeeab06f50fd68
Trace d'emulation JS (ordonnee) UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
517032702d6fdebe56eeeab06f50fd68
Deobfuscated PowerShell UNKNWOWNmalicious
(New-Ohuhuhuhuhuhuhuhuhuhuhu
517032702d6fdebe56eeeab06f50fd68 › 517032702d6fdebe56eeeab06f50fd68.emulated › [Command #1] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙