MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0dba4b85fa20faee019dfe6d6ac86a5832dfe9f7a02cf1186e2790461c165fa1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0dba4b85fa20faee019dfe6d6ac86a5832dfe9f7a02cf1186e2790461c165fa1
SHA3-384 hash:	689f5055fd207d13d43c724fc9f7fc36b14d726c2c9bb45dfb292e2fffa7dc5b812dc9ff7b9ea789dccb19b36c88ff4b
SHA1 hash:	e70aee18879fe0b6c2c44660df4a10638eb27b4c
MD5 hash:	226921f1f3afae1995a82d36480a35a5
humanhash:	quiet-november-music-johnny
File name:	htaallofus.hta
Download:	download sample
File size:	27'374 bytes
First seen:	2026-09-02 03:28:31 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	768:wZBsjBjrAyhtbgt4MiIO/5/9SLTHDf4Slf4SaQZ:cMMvjfvlfvam
TLSH	T160C2835982F20821055770359EBF6E4876795A23654CEC0CBD8C9940BF6E9B38DF7BE0
Magika	html
Reporter	abuse_ch
Tags:	hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

75

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.HTML-46839.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/0dba4b85fa20faee019dfe6d6ac86a5832dfe9f7a02cf1186e2790461c165fa1/results/dashboard

Payload URLs

URL

File name

https://l.cdn-fileserver.com/bping.php?hvsid=00001788319584445013976839685867&vgd_cage=53&vgd_oreqf=one&prid=8PR11258V&cid=8CUHL418T&ugd=4&lper=100&wsip=170763298&ssld=

HTA File

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a979806225cbf911f4ded55/reports/cc5d698b-bfae-4543-882e-55cee9fd647c/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/0dba4b85fa20faee019dfe6d6ac86a5832dfe9f7a02cf1186e2790461c165fa1

Joe Sandbox clean

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

3 / 100

Link:

https://www.joesandbox.com/analysis/1967107

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Susipicious

Score:

42%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/0dba4b85fa20faee019dfe6d6ac86a5832dfe9f7a02cf1186e2790461c165fa1

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/226921f1f3afae1995a82d36480a35a5

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0dba4b85fa20faee019dfe6d6ac86a5832dfe9f7a02cf1186e2790461c165fa1/

ReversingLabs TitaniumCloud

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bw5exbp2ed5o4am57zwwvsdklazn72pxuawpcgdoe6iemhawl6qq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery

Link:

https://tria.ge/reports/260902-d1yx4swzet/

Behaviour

System Location Discovery: System Language Discovery

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/0dba4b85fa20faee019dfe6d6ac86a5832dfe9f7a02cf1186e2790461c165fa1