Malicious
Malicious

de7daf6a06d6fdc10947040db588c61f

JavaScript
MD5: de7daf6a06d6fdc10947040db588c61f
Size: 183.99 KB
application/javascript
Ctrl + scroll to zoom · drag to pan

This sample is a 179.7 KB JavaScript classified as malicious by Malva.RE. Static analysis extracted 32 embedded or derived files. It matches 8 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001, T1059.005, T1059.007 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
c2b9339fc1c23823d40619947e8bbc362fd4da1ab25cbef11c1b34ff9d683931
MD5
de7daf6a06d6fdc10947040db588c61f
Verdict
Malicious
File type
JavaScript · 179.7 KB
MITRE ATT&CK
T1027T1059.001T1059.005T1059.007T1105

Cite this report: https://app.malva.re/sha256/c2b9339fc1c23823d40619947e8bbc362fd4da1ab25cbef11c1b34ff9d683931

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
JavaScript file
Size
183.99 KB · 183,994 B
First seen
2026-11-02 06:30 · 3 hours ago
Last seen
2026-11-02 06:30 · 3 hours ago
Last analysis
2026-11-02 06:30 · 3 hours ago
Hashes
MD5 de7daf6a06d6fdc10947040db588c61f Sha1 ca386b95da01f7282f322eb46022598758fb3152 Sha256 c2b9339fc1c23823d40619947e8bbc362fd4da1ab25cbef11c1b34ff9d683931 Sha384 ff14c7d2aaac104a62574232ce6a19dccbcd369d4421966bf4293164f9dea1e970aee156be01975fd0e9dab652b5d243 Sha512 10864e995f36052b8423bf449c513ba55f42108da033773136e765589af4c55a94d3d2c78f82ed64e7a9039bc3e84a9cbf7cccea6d38b0178246d673aad118cb SSDeep 1536:YG7/LyGT7XdK5iNbrSrGpmM+Qme5hpV8gdbjhwia73muMgj0I0YZs7iKfuByyuxu:cp TLSH FA04E5A30352466F66C106D88105B12F58FAEEA7A06D60ADFF136DDFFC1D99580F8722

5 malicious · 33 files
JSde7daf6a06d6fdc10947040db588c61f
BINde7daf6a06d6fdc10947040db588c61f.emulated
JS[Stage #1].js
PS1[PowerShell Command]
PS1[Deobfuscated PS]
IMG0x00000E46.svg
IMG0x00000E46.svg-preview.jpg
IMG0x00004C0F.svg
IMG0x00004C0F.svg-preview.jpg
IMG0x00004F66.svg
IMG0x00004F66.svg-preview.jpg
IMG0x0000911A.svg
IMG0x0000911A.svg-preview.jpg
IMG0x00009401.svg
IMG0x00009401.svg-preview.jpg
IMG0x000097CF.svg
IMG0x000097CF.svg-preview.jpg
IMG0x00009984.svg
IMG0x00009984.svg-preview.jpg
VBS[Stage #1].js.deobfuscated.vbs
IMG0x00000842.svg
IMG0x00000842.svg-preview.jpg
IMG0x000042C3.svg
IMG0x000042C3.svg-preview.jpg
IMG0x000045B3.svg
IMG0x000045B3.svg-preview.jpg
IMG0x0000878D.svg
IMG0x0000878D.svg-preview.jpg
IMG0x00008A77.svg
IMG0x00008A77.svg-preview.jpg
IMG0x00008E71.svg
IMG0x00008E71.svg-preview.jpg
IMG0x00009038.svg
IMG0x00009038.svg-preview.jpg
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:js~T1027~T1059.005~T1059.007>scr:ps1~T1027~T1059.001~T1105>img
Shape scr:js>scr:ps1>img
malicious 3 nodes
Path scr:js~T1027~T1059.005~T1059.007>img
Shape scr:js>img
malicious 2 nodes

Trace d'emulation JS (ordonnee) UNKNWOWNmalicious
#? evhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

5 malicious · 33 files
JSde7daf6a06d6fdc10947040db588c61f
BINde7daf6a06d6fdc10947040db588c61f.emulated
JS[Stage #1].js
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBS[Stage #1].js.deobfuscated.vbs
No malware configuration was found at this point.

Trace d'emulation JS (ordonnee) UNKNWOWNmalicious
#? evhuhuhuhuhuhuhuhuhuhuhu
de7daf6a06d6fdc10947040db588c61f
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙