{
    "data": {
        "id": "049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9",
        "type": "file",
        "links": {
            "self": "https://www.virustotal.com/api/v3/files/049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9"
        },
        "attributes": {
            "ssdeep": "6144:mZ7yf+/wg1IwxS2+YTP92mc2T7bTI/EfQf8LbibAnnEvS4FHT:M7S+YeIgzTV28T7brQf8Lm0EjT",
            "type_extension": "js",
            "last_analysis_date": 1779446550,
            "meaningful_name": "extracted-decoded.js",
            "last_submission_date": 1778868543,
            "sha256": "049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9",
            "unique_sources": 1,
            "sha1": "dd1b7f7488826448dc204228ee14dced91b82dd3",
            "md5": "6b1cdb94f77cf51e0f2ca52d3549d404",
            "last_analysis_stats": {
                "malicious": 3,
                "suspicious": 0,
                "undetected": 57,
                "harmless": 0,
                "timeout": 0,
                "confirmed-timeout": 0,
                "failure": 1,
                "type-unsupported": 14
            },
            "last_analysis_results": {
                "Bkav": {
                    "method": "blacklist",
                    "engine_name": "Bkav",
                    "engine_version": "8.2.40(8338)",
                    "engine_update": "20260521",
                    "category": "undetected",
                    "result": null
                },
                "Lionic": {
                    "method": "blacklist",
                    "engine_name": "Lionic",
                    "engine_version": "8.16",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Cynet": {
                    "method": "blacklist",
                    "engine_name": "Cynet",
                    "engine_version": "4.0.3.4",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "CMC": {
                    "method": "blacklist",
                    "engine_name": "CMC",
                    "engine_version": "2.4.2022.1",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "CAT-QuickHeal": {
                    "method": "blacklist",
                    "engine_name": "CAT-QuickHeal",
                    "engine_version": "22.00",
                    "engine_update": "20260521",
                    "category": "undetected",
                    "result": null
                },
                "Skyhigh": {
                    "method": "blacklist",
                    "engine_name": "Skyhigh",
                    "engine_version": "v2021.2.0+4045",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "ALYac": {
                    "method": "blacklist",
                    "engine_name": "ALYac",
                    "engine_version": "2.0.0.10",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Malwarebytes": {
                    "method": "blacklist",
                    "engine_name": "Malwarebytes",
                    "engine_version": "3.1.0.235",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Zillya": {
                    "method": "blacklist",
                    "engine_name": "Zillya",
                    "engine_version": "2.0.0.5606",
                    "engine_update": "20260521",
                    "category": "undetected",
                    "result": null
                },
                "Sangfor": {
                    "method": "blacklist",
                    "engine_name": "Sangfor",
                    "engine_version": "2.22.3.0",
                    "engine_update": "20260518",
                    "category": "undetected",
                    "result": null
                },
                "K7AntiVirus": {
                    "method": "blacklist",
                    "engine_name": "K7AntiVirus",
                    "engine_version": "14.53.59583",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "K7GW": {
                    "method": "blacklist",
                    "engine_name": "K7GW",
                    "engine_version": "14.53.59582",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "CrowdStrike": {
                    "method": "blacklist",
                    "engine_name": "CrowdStrike",
                    "engine_version": "1.0",
                    "engine_update": "20251219",
                    "category": "undetected",
                    "result": null
                },
                "Arcabit": {
                    "method": "blacklist",
                    "engine_name": "Arcabit",
                    "engine_version": "2025.0.0.23",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "VirIT": {
                    "method": "blacklist",
                    "engine_name": "VirIT",
                    "engine_version": "9.5.1212",
                    "engine_update": "20260521",
                    "category": "undetected",
                    "result": null
                },
                "Symantec": {
                    "method": "blacklist",
                    "engine_name": "Symantec",
                    "engine_version": "1.22.0.0",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "ESET-NOD32": {
                    "method": "blacklist",
                    "engine_name": "ESET-NOD32",
                    "engine_version": "18.2.18.0",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "TrendMicro-HouseCall": {
                    "method": "blacklist",
                    "engine_name": "TrendMicro-HouseCall",
                    "engine_version": "24.550.0.1002",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Avast": {
                    "method": "blacklist",
                    "engine_name": "Avast",
                    "engine_version": "23.9.8494.0",
                    "engine_update": "20260515",
                    "category": "undetected",
                    "result": null
                },
                "ClamAV": {
                    "method": "blacklist",
                    "engine_name": "ClamAV",
                    "engine_version": "1.5.2.0",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Kaspersky": {
                    "method": "blacklist",
                    "engine_name": "Kaspersky",
                    "engine_version": "22.0.1.28",
                    "engine_update": "20260522",
                    "category": "malicious",
                    "result": "HEUR:Trojan-PSW.NodeJS.Agent"
                },
                "BitDefender": {
                    "method": "blacklist",
                    "engine_name": "BitDefender",
                    "engine_version": "7.2",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "NANO-Antivirus": {
                    "method": "blacklist",
                    "engine_name": "NANO-Antivirus",
                    "engine_version": "1.0.170.26895",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "ViRobot": {
                    "method": "blacklist",
                    "engine_name": "ViRobot",
                    "engine_version": "2014.3.20.0",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "MicroWorld-eScan": {
                    "method": "blacklist",
                    "engine_name": "MicroWorld-eScan",
                    "engine_version": "14.0.409.0",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Rising": {
                    "method": "blacklist",
                    "engine_name": "Rising",
                    "engine_version": "25.0.0.28",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Sophos": {
                    "method": "blacklist",
                    "engine_name": "Sophos",
                    "engine_version": "3.5.1.0",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "F-Secure": {
                    "method": "blacklist",
                    "engine_name": "F-Secure",
                    "engine_version": "18.10.1547.307",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "DrWeb": {
                    "method": "blacklist",
                    "engine_name": "DrWeb",
                    "engine_version": "7.0.75.2070",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "VIPRE": {
                    "method": "blacklist",
                    "engine_name": "VIPRE",
                    "engine_version": "6.0.0.35",
                    "engine_update": "20260521",
                    "category": "undetected",
                    "result": null
                },
                "TrendMicro": {
                    "method": "blacklist",
                    "engine_name": "TrendMicro",
                    "engine_version": "24.550.0.1002",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "McAfeeD": {
                    "method": "blacklist",
                    "engine_name": "McAfeeD",
                    "engine_version": "1.2.0.14532",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "CTX": {
                    "method": "blacklist",
                    "engine_name": "CTX",
                    "engine_version": "2024.8.29.1",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Emsisoft": {
                    "method": "blacklist",
                    "engine_name": "Emsisoft",
                    "engine_version": "2024.8.0.61147",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "huorong": {
                    "method": "blacklist",
                    "engine_name": "huorong",
                    "engine_version": "4d5a467:4d5a467:beb3574:beb3574",
                    "engine_update": "20260521",
                    "category": "malicious",
                    "result": "HEUR:TrojanSpy/JS.Stealer.b"
                },
                "Jiangmin": {
                    "method": "blacklist",
                    "engine_name": "Jiangmin",
                    "engine_version": "16.0.100",
                    "engine_update": "20260521",
                    "category": "undetected",
                    "result": null
                },
                "Avira": {
                    "method": "blacklist",
                    "engine_name": "Avira",
                    "engine_version": "8.3.3.24",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Antiy-AVL": {
                    "method": "blacklist",
                    "engine_name": "Antiy-AVL",
                    "engine_version": "3.0",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Kingsoft": {
                    "method": "blacklist",
                    "engine_name": "Kingsoft",
                    "engine_version": "None",
                    "engine_update": "20260520",
                    "category": "undetected",
                    "result": null
                },
                "Gridinsoft": {
                    "method": "blacklist",
                    "engine_name": "Gridinsoft",
                    "engine_version": "1.0.245.174",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Xcitium": {
                    "method": "blacklist",
                    "engine_name": "Xcitium",
                    "engine_version": "38668",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Microsoft": {
                    "method": "blacklist",
                    "engine_name": "Microsoft",
                    "engine_version": "1.1.26040.8",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "SUPERAntiSpyware": {
                    "method": "blacklist",
                    "engine_name": "SUPERAntiSpyware",
                    "engine_version": "5.6.0.1032",
                    "engine_update": "20260521",
                    "category": "undetected",
                    "result": null
                },
                "ZoneAlarm": {
                    "method": "blacklist",
                    "engine_name": "ZoneAlarm",
                    "engine_version": "6.25-116106978",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "GData": {
                    "method": "blacklist",
                    "engine_name": "GData",
                    "engine_version": "GD:27.44632AVA:64.31285",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Varist": {
                    "method": "blacklist",
                    "engine_name": "Varist",
                    "engine_version": "6.6.1.3",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "AhnLab-V3": {
                    "method": "blacklist",
                    "engine_name": "AhnLab-V3",
                    "engine_version": "3.30.0.10666",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Acronis": {
                    "method": "blacklist",
                    "engine_name": "Acronis",
                    "engine_version": "1.2.0.121",
                    "engine_update": "20240328",
                    "category": "undetected",
                    "result": null
                },
                "VBA32": {
                    "method": "blacklist",
                    "engine_name": "VBA32",
                    "engine_version": "5.6.1",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "TACHYON": {
                    "method": "blacklist",
                    "engine_name": "TACHYON",
                    "engine_version": "2026-05-22.02",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Zoner": {
                    "method": "blacklist",
                    "engine_name": "Zoner",
                    "engine_version": "2.2.2.0",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Tencent": {
                    "method": "blacklist",
                    "engine_name": "Tencent",
                    "engine_version": "1.0.0.1",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Yandex": {
                    "method": "blacklist",
                    "engine_name": "Yandex",
                    "engine_version": "5.5.2.24",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "TrellixENS": {
                    "method": "blacklist",
                    "engine_name": "TrellixENS",
                    "engine_version": "6.0.6.653",
                    "engine_update": "20260521",
                    "category": "undetected",
                    "result": null
                },
                "Ikarus": {
                    "method": "blacklist",
                    "engine_name": "Ikarus",
                    "engine_version": "6.4.16.0",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "MaxSecure": {
                    "method": "blacklist",
                    "engine_name": "MaxSecure",
                    "engine_version": "1.0.0.1",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "Fortinet": {
                    "method": "blacklist",
                    "engine_name": "Fortinet",
                    "engine_version": "7.0.48.0",
                    "engine_update": "20260522",
                    "category": "undetected",
                    "result": null
                },
                "AVG": {
                    "method": "blacklist",
                    "engine_name": "AVG",
                    "engine_version": "23.9.8494.0",
                    "engine_update": "20260515",
                    "category": "undetected",
                    "result": null
                },
                "Panda": {
                    "method": "blacklist",
                    "engine_name": "Panda",
                    "engine_version": "4.6.4.2",
                    "engine_update": "20260521",
                    "category": "undetected",
                    "result": null
                },
                "alibabacloud": {
                    "method": "blacklist",
                    "engine_name": "alibabacloud",
                    "engine_version": "2.2.0",
                    "engine_update": "20250321",
                    "category": "malicious",
                    "result": "Trojan[stealer]:NodeJS/Agent.Gen"
                },
                "Google": {
                    "method": "blacklist",
                    "engine_name": "Google",
                    "engine_version": "1779436879",
                    "engine_update": "20260522",
                    "category": "failure",
                    "result": null
                },
                "Avast-Mobile": {
                    "method": "blacklist",
                    "engine_name": "Avast-Mobile",
                    "engine_version": "260522-00",
                    "engine_update": "20260522",
                    "category": "type-unsupported",
                    "result": null
                },
                "SymantecMobileInsight": {
                    "method": "blacklist",
                    "engine_name": "SymantecMobileInsight",
                    "engine_version": "2.0",
                    "engine_update": "20260123",
                    "category": "type-unsupported",
                    "result": null
                },
                "BitDefenderFalx": {
                    "method": "blacklist",
                    "engine_name": "BitDefenderFalx",
                    "engine_version": "2.0.936",
                    "engine_update": "20260520",
                    "category": "type-unsupported",
                    "result": null
                },
                "DeepInstinct": {
                    "method": "blacklist",
                    "engine_name": "DeepInstinct",
                    "engine_version": "5.0.0.8",
                    "engine_update": "20260516",
                    "category": "type-unsupported",
                    "result": null
                },
                "Elastic": {
                    "method": "blacklist",
                    "engine_name": "Elastic",
                    "engine_version": "4.0.261",
                    "engine_update": "20260521",
                    "category": "type-unsupported",
                    "result": null
                },
                "APEX": {
                    "method": "blacklist",
                    "engine_name": "APEX",
                    "engine_version": "6.781",
                    "engine_update": "20260522",
                    "category": "type-unsupported",
                    "result": null
                },
                "Trapmine": {
                    "method": "blacklist",
                    "engine_name": "Trapmine",
                    "engine_version": "4.0.12.0",
                    "engine_update": "20260504",
                    "category": "type-unsupported",
                    "result": null
                },
                "Paloalto": {
                    "method": "blacklist",
                    "engine_name": "Paloalto",
                    "engine_version": "0.9.0.1003",
                    "engine_update": "20260522",
                    "category": "type-unsupported",
                    "result": null
                },
                "Alibaba": {
                    "method": "blacklist",
                    "engine_name": "Alibaba",
                    "engine_version": "0.3.0.5",
                    "engine_update": "20190527",
                    "category": "type-unsupported",
                    "result": null
                },
                "Webroot": {
                    "method": "blacklist",
                    "engine_name": "Webroot",
                    "engine_version": "1.9.0.8",
                    "engine_update": "20250227",
                    "category": "type-unsupported",
                    "result": null
                },
                "Cylance": {
                    "method": "blacklist",
                    "engine_name": "Cylance",
                    "engine_version": "3.0.0.0",
                    "engine_update": "20260521",
                    "category": "type-unsupported",
                    "result": null
                },
                "SentinelOne": {
                    "method": "blacklist",
                    "engine_name": "SentinelOne",
                    "engine_version": "7.6.2.19",
                    "engine_update": "20260324",
                    "category": "type-unsupported",
                    "result": null
                },
                "tehtris": {
                    "method": "blacklist",
                    "engine_name": "tehtris",
                    "engine_version": "v0.1.4",
                    "engine_update": "20260522",
                    "category": "type-unsupported",
                    "result": null
                },
                "Trustlook": {
                    "method": "blacklist",
                    "engine_name": "Trustlook",
                    "engine_version": "1.0",
                    "engine_update": "20260522",
                    "category": "type-unsupported",
                    "result": null
                }
            },
            "type_tag": "javascript",
            "vhash": "ed0b262bb3a2176c5b5346412d32e865",
            "magic": "ASCII text, with very long lines (65342u), with CRLF line terminators",
            "tags": [
                "javascript",
                "long-sleeps",
                "idle"
            ],
            "times_submitted": 2,
            "reputation": 0,
            "first_submission_date": 1778868511,
            "total_votes": {
                "harmless": 0,
                "malicious": 0
            },
            "size": 430388,
            "javascript_info": {
                "tags": [
                    "charAt",
                    "charCodeAt",
                    "replace",
                    "write",
                    "substr",
                    "location",
                    "malformed",
                    "Math",
                    "fromCharCode"
                ]
            },
            "sandbox_verdicts": {
                "Zenbox": {
                    "category": "malicious",
                    "malware_classification": [
                        "MALWARE",
                        "EVADER"
                    ],
                    "sandbox_name": "Zenbox",
                    "confidence": 68
                }
            },
            "type_tags": [
                "source",
                "javascript",
                "js"
            ],
            "crowdsourced_yara_results": [
                {
                    "ruleset_id": "00c3b8eb5d",
                    "ruleset_version": "00c3b8eb5d|e76c93dcdedff04076380ffc60ea54e45b313635",
                    "ruleset_name": "indicator_suspicious",
                    "rule_name": "INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs",
                    "match_date": 1779446731,
                    "description": "Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.",
                    "author": "ditekSHen",
                    "source": "https://github.com/ditekshen/detection"
                },
                {
                    "ruleset_id": "0122a7f913",
                    "ruleset_version": "0122a7f913|589bbefc22847193cac455858fa15e627d671918",
                    "ruleset_name": "Windows_API_Function",
                    "rule_name": "Windows_API_Function",
                    "match_date": 1779446731,
                    "description": "This signature detects the presence of a number of Windows API functionality often seen within embedded executables. When this signature alerts on an executable, it is not an indication of malicious behavior. However, if seen firing in other file types, deeper investigation may be warranted.",
                    "author": "InQuest Labs",
                    "source": "https://github.com/InQuest/yara-rules-vt"
                },
                {
                    "ruleset_id": "01548f5e9f",
                    "ruleset_version": "01548f5e9f|fc8633fd1aca367bd7e986a2e62f6851b150ad8f",
                    "ruleset_name": "Macos_Infostealer_Wallets",
                    "rule_name": "Macos_Infostealer_Wallets_8e469ea0",
                    "match_date": 1779446731,
                    "author": "Elastic Security",
                    "source": "https://github.com/elastic/protections-artifacts"
                }
            ],
            "popular_threat_classification": {
                "popular_threat_name": [
                    {
                        "count": 2,
                        "value": "nodejs"
                    },
                    {
                        "count": 2,
                        "value": "stealer"
                    }
                ],
                "popular_threat_category": [
                    {
                        "count": 3,
                        "value": "trojan"
                    }
                ],
                "suggested_threat_label": "trojan.nodejs/stealer"
            },
            "names": [
                "extracted-decoded.js"
            ],
            "type_description": "JavaScript",
            "tlsh": "T13494A62EC5719D3B8A1249DC2AD13F11BC0773E1D149A268368CC269ABCD47DA2DDDEC",
            "last_modification_date": 1779446731,
            "filecondis": {
                "dhash": "dcac1e8e8ca68484",
                "raw_md5": "130eee41e3afba72f4dfef2558fe0b05"
            }
        }
    }
}