Hostile 92% javascript Download

@chikawa222224/testchikawa222224 2026.9.23-1-25

Typosquatting, high release velocity, binary payload

“Hash utility for the bundled binary release asset”

DOS COM walks a directory and writesLarge registry install base (10k+ downloads)

Evidence

DOS find-first through a near call line 205434
2054342�L(;�~�0+�yݺ�������`�IK���^�H�xQJS{&�ܐ?��"J~1���q��$\TE��JQ����i(v�*�c�c4������\�5"LR�<�U�X��j;6}������܊z�l��,��N+�sN��R��A>LMR< z�3?F ]ͤ9��tF��iDBm6%'����4�t�)d�+jm���/l&��$�܌��Es{X�v� �~�V�{�j�Zy*�kZ�(����P��$W�En��[.d��]�N���!������F�_�� A�i�c.�@�ls�J8��x��Hſ_���<<�_=�t=q�1sU�dvH���A5�SWx��¢u|�eapU�@�ʥM#ȏ<�a _ �1��--e�t�1�k����Ck,.�~���,�P R��L&5��
DOS find-next through a near call line 245924
245924��M�>�K�>]w� ������Y�ʴ�kĊ=�~���ɓ�1�����jae IV�od�2�ԓb���M&ٽg�!Yu�l���j��"����R��]Jt �:��r�L�]v�bǽ�f��1���r�Of����:p0/��drm ��E�w���� ڵ�Oܴ��£��eË�;���sEp�6�����8���b��b����nq��otSy��wSveǚ��h�8M�%Ŋ˥ ��o�7�~���[.�������Q��#��@���e��co�&���3,B��#NS���d�,�����,���'�?oI�����*3��U�� ��.�:t�]S\7d�5 �x ��@-�U�,�?zW�,a���\[@g��F �W]T5.Ѣs=D;_e Aa����yӈM�^x�u�
DOS write through a near call line 779550
779550�6��=n�c_V�������D�1���o��X�փ���޳�l�0qe�eD�A ����+�n�_ {�@�`wZ�W=F]��=�U�[ �^}𸃞�`�8��r��γ�6����5e" .�vR�<��r1l7�8�[d)�r��:�ia��h�B���W�8�C��ͻ/�|�D�yzX ��YYgL�ؿ]_��Q�4�q_�ud��� v
DOS find-next via MOV AX line 10750331
10750331���"�k��@�:;��q��@%�x�\��-� I��8j�N;~��-usN��L�A� �I2)F-���������L�|��� s���|.�]Rye�2�6�{Xb������\g���B����L�!��[��5O�Z��;˳E�!���U�G��^� ^b�ݔ3|q�1`s ���~D�Ȁb���2m2Kx r̴���l�'��|�=�� ��q� �y:�bӾ檧h� v ���ܒ�z 蝘Qd@af�.�H����-,`�Jt�PsMa\�Fַ�3d��)f+;32s��k�� �q�=GLAxy�"ͳ"Fp�vǘ�J�\�O5�S��ч�Q�,�-�<�%0m8�����+��% �B� ������� .��L��� t���3��A
DOS writes a file via INT 21h line 37170124
37170124��@�0�7=RLv�T�\R��� =��;޻������[k�j�㼇ӗ���X����8ϋ"a���@8�N��?/�˼�a�9K�@_Ge�������![����Td�<�B�&��Z%sa�b���h��6�R��v,� K�$�*E����!��R�I�/��* j�=)���LJ�՞�}�v۟�đ-��~�jxKB��U��;���zMʇu

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.