Malicious
JavaScript
MD5: 517032702d6fdebe56eeeab06f50fd68
Size: 13.16 KB
application/javascript
Ctrl + scroll to zoom · drag to pan
This sample is a 12.9 KB JavaScript classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001, T1059.007 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- b56f0e17c790eceba2dc707d9f983bb8caf265a68205b0eb2cca7410e4fc4a64
- MD5
- 517032702d6fdebe56eeeab06f50fd68
- Verdict
- Malicious
- File type
- JavaScript · 12.9 KB
Cite this report: https://app.malva.re/sha256/b56f0e17c790eceba2dc707d9f983bb8caf265a68205b0eb2cca7410e4fc4a64
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
JavaScript file
Size
13.16 KB · 13,164 B
Hashes
MD5
517032702d6fdebe56eeeab06f50fd68
Sha1
9e879ae26e3aa840f1df6afad8086b70ad807b26
Sha256
b56f0e17c790eceba2dc707d9f983bb8caf265a68205b0eb2cca7410e4fc4a64
Sha384
9895f2ecd36cd738220950cddb1e653028a1104b112c8b8dfa850afe295706e51f0ccdc32e294f9c79ede555e24dc5ee
Sha512
815467d420e78e4d5c7301d15aac4ba15c7e004202f6b3363a53280b468bca6cde7af9b7d3d074f83b9a5f13063ba165251d51ee1ef884575b0574e46d28d5b1
SSDeep
96:yHYVPXTkmnHYVPXTkmnHYVPXTkm6k9jqTNh7fHYVPXTkmnHYVPXTkmnHYVPXTkmL:dVLkxVLkxVLk9BTNh7wVLkxVLkxVLkC
TLSH
C942BBC679CCD76528BB72878130B7585B6DCDAAF110B1E7372C69CF3C4298A42A631D
4 malicious · 4 files
JS517032702d6fdebe56eeeab06f50fd68T1027 · T1105 · T1059.001
BIN517032702d6fdebe56eeeab06f50fd68.emulated
SH[Command #1]T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:js~T1059.007~T1105>scr:bat>scr:ps1~T1027~T1059.001~T1105
Shape
scr:js>scr:bat>scr:ps1
malicious
3 nodes
Command (emulation JS) #1
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Command (emulation JS) #2
UNKNWOWNmalicious
"huhuhuhu
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
(New-Ohuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential