Malicious
f462270dd43a9c9f20dcf93f6eb21483
JavaScript
MD5: f462270dd43a9c9f20dcf93f6eb21483
Size: 4.13 MB
application/javascript
Ctrl + scroll to zoom · drag to pan
This sample is a 3.9 MB JavaScript classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 9aab8281d2cf4f8405ce38d3965913065b15208b9fdabb43d16f70344221d237
- MD5
- f462270dd43a9c9f20dcf93f6eb21483
- Verdict
- Malicious
- File type
- JavaScript · 3.9 MB
Cite this report: https://app.malva.re/sha256/9aab8281d2cf4f8405ce38d3965913065b15208b9fdabb43d16f70344221d237
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
JavaScript file
Size
4.13 MB · 4,129,411 B
First seen
2026-10-26 07:45 · 6 hours ago
Last seen
2026-10-26 07:45 · 6 hours ago
Last analysis
2026-10-26 07:46 · 6 hours ago
Hashes
MD5
f462270dd43a9c9f20dcf93f6eb21483
Sha1
6ad070226bd1ea067af941ea0a30542156007bbf
Sha256
9aab8281d2cf4f8405ce38d3965913065b15208b9fdabb43d16f70344221d237
Sha384
3021c7216c5657f8253899bdef0a1060bd38a3e3ac8492b872b6214f3e8e0337f093596c5faf8d39aa7bc787fedf4a11
Sha512
a42414e2c54dce0a73955aff9f507dddbef53224a6e5b248342a7f0f00aa6f83bb23fd50c03bf952e71990f5d232b2fe49e0411c44c8470df3dc477bfa31f2e9
SSDeep
98304:Y9aInejlIeD6rpKNbRYktNe8OhJa2RPJxxZK5tRoxAjvsm/bcMUTGScXsLUJTaTJ:KBrK6NgVYuoJLQ5oOzsSbcMUTgXDJTj0
TLSH
FD16D25213876631372FCB5EC1369A21461E514B26D4EB3D32BCE34A727EA1B6F4C4E2
4 malicious · 4 files
JSf462270dd43a9c9f20dcf93f6eb21483T1027 · T1059.001 · T1059.007
BINf462270dd43a9c9f20dcf93f6eb21483.emulated
SH[Command #1]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:js~T1059.007>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:js>scr:bat>scr:ps1
malicious
3 nodes
Command (emulation JS) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (emulation JS) #2
UNKNWOWNmalicious
\UHCVShuhuhuhuhuhuhuhuhuhuhu
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
ehuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential4 malicious · 4 files
JSf462270dd43a9c9f20dcf93f6eb21483T1027 · T1059.001 · T1059.007
BINf462270dd43a9c9f20dcf93f6eb21483.emulated
SH[Command #1]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
No malware configuration was found at this point.
Command (emulation JS) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
f462270dd43a9c9f20dcf93f6eb21483
Command (emulation JS) #2
UNKNWOWNmalicious
\UHCVShuhuhuhuhuhuhuhuhuhuhu
f462270dd43a9c9f20dcf93f6eb21483
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
f462270dd43a9c9f20dcf93f6eb21483
Deobfuscated PowerShell
UNKNWOWNmalicious
ehuhuhuhu
f462270dd43a9c9f20dcf93f6eb21483 › f462270dd43a9c9f20dcf93f6eb21483.emulated › [Command #1] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account