Malicious
JavaScript
MD5: b280d543b9013e1d06d5aa7038715f4b
Size: 3.39 MB
application/javascript
Ctrl + scroll to zoom · drag to pan
This sample is a 3.2 MB JavaScript classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- c53e19da585dfe14c009b3d8f7b79e78a9bff5cdfa6f47231be4fa31c8363560
- MD5
- b280d543b9013e1d06d5aa7038715f4b
- Verdict
- Malicious
- File type
- JavaScript · 3.2 MB
Cite this report: https://app.malva.re/sha256/c53e19da585dfe14c009b3d8f7b79e78a9bff5cdfa6f47231be4fa31c8363560
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
JavaScript file
Size
3.39 MB · 3,393,961 B
First seen
2026-10-26 07:45 · 5 hours ago
Last seen
2026-10-26 07:45 · 5 hours ago
Last analysis
2026-10-26 07:46 · 5 hours ago
Hashes
MD5
b280d543b9013e1d06d5aa7038715f4b
Sha1
350658fa8e0f402272ee6b16ee3d58ffbaed403d
Sha256
c53e19da585dfe14c009b3d8f7b79e78a9bff5cdfa6f47231be4fa31c8363560
Sha384
fc9f0368908cebcb4f7ba04fbf269e98c2a45669312166fe59469ad49cbd657fa0c8e83e0ff5b76345f85f8bc6f57445
Sha512
8bbe0cdf2c77f4378395d55f5cdef27ceba20871703abb0bf89faa966203417a8adb81a1c8e3ec15eebf6299b59b8c3e0083b2a8121da7e597416662f6cf3059
SSDeep
98304:dOXPJWG3LStiE9LUHdmvf23CmV0qU+0NOdnr9vsTQFpJYlaBAT0sVmhz0t9fSPcS:dUUtLtKP/+AUt3E
TLSH
DBF5F98152CBA970763FE72DD4329A510A5D25072188BF3E35F8175BA3B37232F8D4A6
4 malicious · 4 files
JSb280d543b9013e1d06d5aa7038715f4bT1027 · T1059.001 · T1059.007
BINb280d543b9013e1d06d5aa7038715f4b.emulated
SH[Command #1]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:js~T1059.007>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:js>scr:bat>scr:ps1
malicious
3 nodes
Command (emulation JS) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (emulation JS) #2
UNKNWOWNmalicious
\MSBYMhuhuhuhuhuhuhuhuhuhuhu
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
ehuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential