Malicious
640f9c8367b194863e2241b9e55c89f5
JavaScript
MD5: 640f9c8367b194863e2241b9e55c89f5
Size: 5.25 MB
application/javascript
Ctrl + scroll to zoom · drag to pan
This sample is a 5 MB JavaScript classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 2b1bedce7c7a7709a2c44b692830fcd93cf4638a8d13541578bb4723d7e58196
- MD5
- 640f9c8367b194863e2241b9e55c89f5
- Verdict
- Malicious
- File type
- JavaScript · 5 MB
Cite this report: https://app.malva.re/sha256/2b1bedce7c7a7709a2c44b692830fcd93cf4638a8d13541578bb4723d7e58196
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
JavaScript file
Size
5.25 MB · 5,248,987 B
First seen
2026-10-26 07:45 · 6 hours ago
Last seen
2026-10-26 07:45 · 6 hours ago
Last analysis
2026-10-26 07:46 · 6 hours ago
Hashes
MD5
640f9c8367b194863e2241b9e55c89f5
Sha1
fc19d4eae4bf1e357bb35416b006cc2f7899042b
Sha256
2b1bedce7c7a7709a2c44b692830fcd93cf4638a8d13541578bb4723d7e58196
Sha384
5f3c874bf8315d75a7e387d8261543062fd0e21105fc665537dd46a28c8236393c1944492b9c62e46c1cbc193979860e
Sha512
74a1e653e1231afb905f164aaea5d28eb2bcc4d80907c51e38f06bdd36ae98889656da33ed50fd39b5a4010345f57fca6fdd61438f4d5a81560a6bcf1ac58698
SSDeep
98304:Afs3x0c/lqsc8ZHTlatKs4kCiJApaCQR8j4HebMAu8aA+sznIOyrkEBSJSiWzDkx:XU4F2+oRqnILDTPv2j70yHGtdZ9JUW7w
TLSH
46361881139B98B0B62FE72DD47699900A9D340351C9EF3D30F82756B7A361B6F8D4E2
4 malicious · 4 files
JS640f9c8367b194863e2241b9e55c89f5T1027 · T1059.001 · T1059.007
BIN640f9c8367b194863e2241b9e55c89f5.emulated
SH[Command #1]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:js~T1059.007>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:js>scr:bat>scr:ps1
malicious
3 nodes
Command (emulation JS) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (emulation JS) #2
UNKNWOWNmalicious
\OUXCJhuhuhuhuhuhuhuhuhuhuhu
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
ehuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential4 malicious · 4 files
JS640f9c8367b194863e2241b9e55c89f5T1027 · T1059.001 · T1059.007
BIN640f9c8367b194863e2241b9e55c89f5.emulated
SH[Command #1]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
No malware configuration was found at this point.
Command (emulation JS) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
640f9c8367b194863e2241b9e55c89f5
Command (emulation JS) #2
UNKNWOWNmalicious
\OUXCJhuhuhuhuhuhuhuhuhuhuhu
640f9c8367b194863e2241b9e55c89f5
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
640f9c8367b194863e2241b9e55c89f5
Deobfuscated PowerShell
UNKNWOWNmalicious
ehuhuhuhu
640f9c8367b194863e2241b9e55c89f5 › 640f9c8367b194863e2241b9e55c89f5.emulated › [Command #1] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account