Malicious
78d58aed4803540680e7e0a02d7ef630
JavaScript
MD5: 78d58aed4803540680e7e0a02d7ef630
Size: 5.48 MB
application/javascript
Ctrl + scroll to zoom · drag to pan
This sample is a 5.2 MB JavaScript classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 9cb0006ba80d05eed418511693eba7bde1d9ef3d6fc4ae4ff877f304758d5cb7
- MD5
- 78d58aed4803540680e7e0a02d7ef630
- Verdict
- Malicious
- File type
- JavaScript · 5.2 MB
Cite this report: https://app.malva.re/sha256/9cb0006ba80d05eed418511693eba7bde1d9ef3d6fc4ae4ff877f304758d5cb7
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
JavaScript file
Size
5.48 MB · 5,477,264 B
First seen
2026-10-26 04:45 · 9 hours ago
Last seen
2026-10-26 04:45 · 9 hours ago
Last analysis
2026-10-26 04:50 · 9 hours ago
Hashes
MD5
78d58aed4803540680e7e0a02d7ef630
Sha1
c5a0327752665dfe6e6620fc1585525df4605184
Sha256
9cb0006ba80d05eed418511693eba7bde1d9ef3d6fc4ae4ff877f304758d5cb7
Sha384
09538aa7d2c0b6c0112a9dbc17580b37e547817a0af4bdf2b3301cdc5fcaaed79fc336fabd7b410cdc6fd0f4242a016b
Sha512
564a4e6863eb5fb4b7de3e321215e26e7ba28e28dbb9c6843ccc4d016f8b17b7dea7039b9ab92a5d6a8f8cf3ecd678f69ede5c5e459311e1e73d0d005c97698a
SSDeep
98304:jJ1UKVme+kbhY5YpxPSTwdd6YZU3Enz6LPdDU7+EtRom79Pfu20tePD5u3mdoEVl:FUe99Y5YLSwLZy4WPdDUltO6Nfn+KnPL
TLSH
5F463881230695F2B62DBB5CD236DAA0F94A640317C6DF3D30BC9316B758D07A75CAE2
4 malicious · 4 files
JS78d58aed4803540680e7e0a02d7ef630T1027 · T1059.001 · T1059.007
BIN78d58aed4803540680e7e0a02d7ef630.emulated
SH[Command #1]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:js~T1059.007>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:js>scr:bat>scr:ps1
malicious
3 nodes
Command (emulation JS) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (emulation JS) #2
UNKNWOWNmalicious
\CBRNWhuhuhuhuhuhuhuhuhuhuhu
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
ehuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential4 malicious · 4 files
JS78d58aed4803540680e7e0a02d7ef630T1027 · T1059.001 · T1059.007
BIN78d58aed4803540680e7e0a02d7ef630.emulated
SH[Command #1]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
No malware configuration was found at this point.
Command (emulation JS) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
78d58aed4803540680e7e0a02d7ef630
Command (emulation JS) #2
UNKNWOWNmalicious
\CBRNWhuhuhuhuhuhuhuhuhuhuhu
78d58aed4803540680e7e0a02d7ef630
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
78d58aed4803540680e7e0a02d7ef630
Deobfuscated PowerShell
UNKNWOWNmalicious
ehuhuhuhu
78d58aed4803540680e7e0a02d7ef630 › 78d58aed4803540680e7e0a02d7ef630.emulated › [Command #1] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account