MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12e09180acdbd6e2620c333973c37aa66347503202015d47bbcf4f278d4461f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	12e09180acdbd6e2620c333973c37aa66347503202015d47bbcf4f278d4461f7
SHA3-384 hash:	2e38737306a4cce60717f0ffce1025bd44566aa1d12fee0fa8af20bb61f58d2b1672f2da8961ccb766b3e3541874aaf4
SHA1 hash:	c9b9f2a8c545b1a64713cc899d8bb5286c911dde
MD5 hash:	cc0a4624dc70e1f547a453bc8ddd5f05
humanhash:	nuts-arizona-hotel-fifteen
File name:	gg2.hta
Download:	download sample
File size:	182 bytes
First seen:	2025-10-02 15:15:36 UTC
Last seen:	2025-10-03 07:51:53 UTC
File type:	hta
MIME type:	text/html
ssdeep	3:qVZx/XMnkAqRAdu6/GY7voOn3ySLFTrHGaR5NWVAohJCRiJURVPR8TbDEHeZNp7G:qzx/XnAqJm79RLhrHvNWVJSqURlST/uL
TLSH	T15EC0C0CF4C91F103C580F8C0FAF0DE21405780848501CC41A8C0803430403DB2C491D6
Magika	html
Reporter	abuse_ch
Tags:	hta

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

43

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68de9737b54520161ad46c6f

Tags:

n/a

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File

Link:

https://app.docguard.net/12e09180acdbd6e2620c333973c37aa66347503202015d47bbcf4f278d4461f7/results/dashboard

Payload URLs

URL

File name

https://www.calix.ai/web/blockpage/index.html?spid=FbDBl4RyAQ&t=3&url=http://8.134.74.227/gg2.hta

HTA File

Hybrid Analysis Trojan/HTML.Redirector

Verdict:

Malicious

Labled as:

Trojan/HTML.Redirector

Link:

https://www.hybrid-analysis.com/sample/12e09180acdbd6e2620c333973c37aa66347503202015d47bbcf4f278d4461f7

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

html

Link:

https://opentip.kaspersky.com/12e09180acdbd6e2620c333973c37aa66347503202015d47bbcf4f278d4461f7/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1788207

Signature

Antivirus detection for URL or domain

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/12e09180acdbd6e2620c333973c37aa66347503202015d47bbcf4f278d4461f7

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/cc0a4624dc70e1f547a453bc8ddd5f05

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/12e09180acdbd6e2620c333973c37aa66347503202015d47bbcf4f278d4461f7/

Neiki Susipicious

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/12e09180acdbd6e2620c333973c37aa66347503202015d47bbcf4f278d4461f7

ReversingLabs TitaniumCloud Document-HTML.Trojan.NetLoader

Threat name:

Document-HTML.Trojan.NetLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-02 15:16:42 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

4 of 38 (10.53%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=clqjdafm3ploeyqmgm4xhq32uzruoubsaiav2r53z5hspdkemh3q._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

adware defense_evasion discovery persistence ransomware spyware stealer trojan

Link:

https://tria.ge/reports/251002-snclnsxrs9/

Behaviour

Modifies Internet Explorer settings

Modifies Internet Explorer start page

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

System Location Discovery: System Language Discovery

Checks whether UAC is enabled

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/12e09180acdbd6e2620c333973c37aa66347503202015d47bbcf4f278d4461f7