Open-source atomic malware analysis

Analyze another

546191fbae56a18d93abc82099ee355532e944fbaec50239c139144af1d42a55.js

JAVASCRIPT
Verdict: HOSTILE
SHA256: 546191fbae56a18d93abc82099ee355532e944fbaec50239c139144af1d42a55 · 97%
Mal-ecule
O₂(As₂S)H(Po)
Size 5.9 KB download
First seen 95 days ago
Analyzed 78 days ago

Objectives

suspicious severity, 90% confident.
anti-static/obfuscation/tools while(!![]) try/parseInt decoder loop
suspicious severity, 92% confident.
supply-chain/hidden-payload a0_0x JavaScript string decoder entrypoint
notable severity, 85% confident.
anti-static/obfuscation/code-metrics High ratio of digit characters (junk padding)
component severity, 100% confident.
anti-static/obfuscation/control-flow Detects retry loop wrapping try-catch (while loop)
component severity, 86% confident.
anti-static/obfuscation/encoding Hex byte decoder constants
component severity, 86% confident.
command-and-control/dropper/lnk ShellLink local base path offset
component severity, 80% confident.
execution/interpreter/script String.fromCharCode fragment (CharCode)
component severity, 90% confident.
persistence/login/ssh JavaScript Windows drive enumeration marker

Micro-behaviors

notable severity, 90% confident.
process/interpreter/scripting JScript conditional compilation activation
baseline severity, 90% confident.
data/encode/permutation Nested loops with multiple charAt calls
baseline severity, 100% confident.
data/source/syntax Obfuscated String method call (String[...])
component severity, 82% confident.
crypto/symmetric/aes JavaScript static key string assignment
component severity, 100% confident.
data/encode toString method token
component severity, 80% confident.
process/create/script Do-while close marker
component severity, 88% confident.
process/create/shell Indirect bracketed WScript command invocation

Metadata

baseline severity, 95% confident.
lang JavaScript or TypeScript basename
component severity, 97% confident.
file/text Validation vocabulary string
component severity, 100% confident.
lang/encoded JavaScript file basename
component severity, 80% confident.
package Short sidecar-sized source

Identity

SHA-256 546191fbae56a18d93abc82099ee355532e944fbaec50239c139144af1d42a55
Filename 546191fbae56a18d93abc82099ee355532e944fbaec50239c139144af1d42a55.js

Origin

Source harvest

Timeline

First seen 14 May 2026 06:52 UTC
First analyzed 31 May 2026 05:23 UTC
Last analyzed 31 May 2026 05:23 UTC
Last updated 31 May 2026 05:23 UTC

Labeling

Label bad
Label source harvest
Traits version 52045