title: Recovered LuaJIT Host Loading the Sample Companion from Documents
id: 59a4ca46-4f66-4d15-971a-5445738bb3c6
status: experimental
description: >-
  Sample-specific interpreter/companion combination. The runtime hash alone is
  not a malicious indicator. Requires a log source that records image hashes.
author: Existing | v1olet
date: 2026-10-23
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains: '\Documents\'
    Hashes|contains: 'SHA256=d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49'
    CommandLine|contains: 'PMJRBUHWKGVCINGZ'
  condition: selection
falsepositives:
  - Authorized analysis or replay of this exact sample in a laboratory
level: high