Malicious
Malicious

d1fccfe6fce8208ad271f3ef4dbb55d2

JavaScript
MD5: d1fccfe6fce8208ad271f3ef4dbb55d2
Size: 4.25 MB
application/javascript
Ctrl + scroll to zoom · drag to pan

This sample is a 4 MB JavaScript classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
411e3f2572813e3410f2ebbc7c396b077c5fa706f1a1bb3e15127e7acbd7e8e0
MD5
d1fccfe6fce8208ad271f3ef4dbb55d2
Verdict
Malicious
File type
JavaScript · 4 MB
MITRE ATT&CK
T1027T1059.001T1059.007

Cite this report: https://app.malva.re/sha256/411e3f2572813e3410f2ebbc7c396b077c5fa706f1a1bb3e15127e7acbd7e8e0

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
JavaScript file
Size
4.25 MB · 4,245,334 B
Hashes
MD5 d1fccfe6fce8208ad271f3ef4dbb55d2 Sha1 f1b28c517ec2cb93649a316cd0e9b3b7d2a12abc Sha256 411e3f2572813e3410f2ebbc7c396b077c5fa706f1a1bb3e15127e7acbd7e8e0 Sha384 9ecd97d5b2b4944f7d9340be464c50e75e00bebe2b1b61df5393acca261ed1e97868e5b9d605492c993bf55c1de57ae9 Sha512 06adf4ff17628f133f80e5ab204bc5083c5801ce9d792fcd8a769c7510d75bd37fd4d7937f76ba7d531012f890b3094aba0a1e11043112a899d8e4d586351b42 SSDeep 98304:LABYYGt1iIxkKh+YXQ2lA1sdB6mNZmH7HZ3x6zI11iihxNDFfX174zTKvHcguYwn:mhAlQz1sdB6ymH75B681hhxRhlYvkln8 TLSH A2166B3C5544E3F260B8F61DC91B7DCA1BE97F571DE0AA7435BC7AA9A288F063328150

4 malicious · 4 files
JSd1fccfe6fce8208ad271f3ef4dbb55d2
BINd1fccfe6fce8208ad271f3ef4dbb55d2.emulated
SH[Command #1]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:js~T1059.007>scr:bat>scr:ps1~T1027~T1059.001
Shape scr:js>scr:bat>scr:ps1
malicious 3 nodes

Command (emulation JS) #1 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (emulation JS) #2 UNKNWOWNmalicious
\VZWMIhuhuhuhuhuhuhuhuhuhuhu
Trace d'emulation JS (ordonnee) UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
ehuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

4 malicious · 4 files
JSd1fccfe6fce8208ad271f3ef4dbb55d2
BINd1fccfe6fce8208ad271f3ef4dbb55d2.emulated
SH[Command #1]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
No malware configuration was found at this point.

Command (emulation JS) #1 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
d1fccfe6fce8208ad271f3ef4dbb55d2
Command (emulation JS) #2 UNKNWOWNmalicious
\VZWMIhuhuhuhuhuhuhuhuhuhuhu
d1fccfe6fce8208ad271f3ef4dbb55d2
Trace d'emulation JS (ordonnee) UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
d1fccfe6fce8208ad271f3ef4dbb55d2
Deobfuscated PowerShell UNKNWOWNmalicious
ehuhuhuhu
d1fccfe6fce8208ad271f3ef4dbb55d2 › d1fccfe6fce8208ad271f3ef4dbb55d2.emulated › [Command #1] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙