Sign up free
Suspicious
Suspect

b16cd3e21ddf8967f3e1c088a1cc9690

Share on LinkedIn
Print
JavaScript
MD5: b16cd3e21ddf8967f3e1c088a1cc9690
Size: 27.15 MB
application/javascript

This sample is a 25.9 MB JavaScript. Malva.RE parsed it statically and found no known malware family, configuration or malicious signature. Static analysis extracted 43 embedded or derived files. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.007. Static analysis cannot prove a file is harmless: an unknown or heavily packed threat can go undetected. The file was parsed and decompiled, never executed.

SHA256
5679fad9147c523a5db5f2e3bf8bcbde8cf44baca6eb706ae30ff20fd306fe5f
MD5
b16cd3e21ddf8967f3e1c088a1cc9690
Verdict
No known threat found
File type
JavaScript · 25.9 MB
MITRE ATT&CK
T1059.007

Cite this report: https://app.malva.re/sha256/5679fad9147c523a5db5f2e3bf8bcbde8cf44baca6eb706ae30ff20fd306fe5f

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
JavaScript (reclassé : grammaire non-VBScript)
Size
27.15 MB · 27,146,424 B
First seen
2026-10-22 01:30 · 12 days ago
Last seen
2026-10-22 01:30 · 12 days ago
Last analysis
2026-10-22 01:32 · 12 days ago
Hashes
MD5 b16cd3e21ddf8967f3e1c088a1cc9690 Sha1 6986cd5a97ae7969dfdc8288fb2476d344cbf1cd Sha256 5679fad9147c523a5db5f2e3bf8bcbde8cf44baca6eb706ae30ff20fd306fe5f Sha384 830dffdbc75519833ab25af7532ef6e090ee41093e1f0ba4f307e60902d6591d437b8d6c016e5041d87b7a6220f00118 Sha512 bf03e545a381d47f75b1a1513190242b8787699c997bec6ac2d8636a535d0a272033c34548348b191e725c1852a0e868e8e57d7085de47a3f8051c48bac6cb8a SSDeep 393216:ZsAJXnt1sNAvHpBocJn4pCu9AV3LFKiVLe+CqTWuQa+nY:ZF1t1swpKAxMAV3LFnVLe+CqTWra8Y TLSH 2A57B051F30B05F6FF434C3645F9AB2F7B39E2DC8974C55AE428242ABAA2C1B45DC291
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft Team

23 files
JSb16cd3e21ddf8967f3e1c088a1cc9690
Structure
P7B[Authenticode]_96f0afb9.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
7 / 7
Path pe:exe~T1059.007>pe:rsrc>pe:dll>pe:rsrc>img
Shape pe:exe>pe:rsrc>pe:dll>pe:rsrc>img
technique5 nodes
Path pe:exe~T1059.007>pe:rsrc>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:rsrc>pe:dll>pe:rsrc>bin
technique5 nodes

Name Value
Info
Authenticode present at 0x19E3200 size 1720 bytes

An error has occurred. This application may no longer respond until reloaded. Reload 🗙