Malicious
JavaScript
MD5: ffefe8ab5f648cdbd55159f5fffcfa14
Size: 3.39 MB
application/javascript
Ctrl + scroll to zoom · drag to pan
This sample is a 3.2 MB JavaScript classified as malicious by Malva.RE. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1059.007 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 9d9ef8a3542d45c542fad69202f1afee4ad8a1696f77977a8313c0de9aae7891
- MD5
- ffefe8ab5f648cdbd55159f5fffcfa14
- Verdict
- Malicious
- File type
- JavaScript · 3.2 MB
Cite this report: https://app.malva.re/sha256/9d9ef8a3542d45c542fad69202f1afee4ad8a1696f77977a8313c0de9aae7891
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
JavaScript file
Size
3.39 MB · 3,388,199 B
Hashes
MD5
ffefe8ab5f648cdbd55159f5fffcfa14
Sha1
a50bcec354ba149ffa7dc15de1d0b8ae747fcc52
Sha256
9d9ef8a3542d45c542fad69202f1afee4ad8a1696f77977a8313c0de9aae7891
Sha384
99c8e569f9c709942abc830f6613848d2b22efd6b130f35e0cc609755331ea46519b8e16464dfb0a5dcb53dd15087c76
Sha512
14c943aef2cbbc039a213338a34a031e34e3c092baee60b6cd5a159d34eb0c88e2b90c4d85151ed0ca145b94d7024713897a1ae49b53ececf8a012657ec8f2ac
SSDeep
98304:zs4ITautHj/Jq2BwzL1c6tifCGQOgglZmSyQ7l4FSIKH1G4L8jETdyE9a0ihC3xU:zsjautHNRJ97vH1dgje9aRojp/vTaHOk
TLSH
7DF5C51FDA305EAA309A5ACCDF65E9E08ECFBB64C355BAD36152935193347931CC23A0
1 malicious · 1 file
JSffefe8ab5f648cdbd55159f5fffcfa14T1105 · T1059.007
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:js~T1059.007~T1105
Shape
scr:js
technique1 nodes
Dropped path (emulation JS) #1
PATHmalicious
\YGTNHhuhuhuhuhuhuhuhuhuhuhu
Dropped path (emulation JS) #2
PATHmalicious
\YGTNHhuhuhuhuhuhuhuhuhuhuhu
Dropped path (emulation JS) #3
PATHmalicious
\YGTNHhuhuhuhuhuhuhuhuhuhuhu
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential