MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18996b3867667a26d543360de3aa752679fa2b91c96539cfe702e60c5325da15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18996b3867667a26d543360de3aa752679fa2b91c96539cfe702e60c5325da15
SHA3-384 hash: 78b24a83e29c48e7ebd8de4860938c65ea83aa8b16b9aa1c5cd34dede3edb9777c2f5f8765009aab940565dab655c4cc
SHA1 hash: 56945fb51f4c142a7ebccb6704e58c35d743ee75
MD5 hash: 13bfc18f6296c7a0eba4371fabd4f818
humanhash: mobile-quiet-india-queen
File name:MaybeWorking.hta
Download: download sample
File size:18'195 bytes
First seen:2026-04-09 06:27:40 UTC
Last seen:2026-04-14 07:44:06 UTC
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 384:xnQKfGFkVALPGTZmRPAr32cKPNgJFjfAA2l7Ns62rgpJH5nsID1IORonlTyKdBHC:U
TLSH T169828E6C09BDFA5893D9E207EA99F7276D461CAFC1B875172AF38C6CA0024C045EB4C7
Magika html
Reporter abuse_ch
Tags:hta

Intelligence

File Origin
# of uploads :
2
# of downloads :
51
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
TwinWave.EvilHTA.DridexEsqCigarettesNAlcohol.M2.20211202.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69d7471166ab6d001dd081a1
Tags:
vmdetect dropper shell sage
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/18996b3867667a26d543360de3aa752679fa2b91c96539cfe702e60c5325da15/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 obfuscated powershell
Link:
https://www.filescan.io/uploads/69d74708799d5bf325f3cbde/reports/672efaf1-d166-4e84-b649-dc9724093935/overview
Verdict:
Malicious
Labled as:
VBS:Electryon.420
Link:
https://www.hybrid-analysis.com/sample/18996b3867667a26d543360de3aa752679fa2b91c96539cfe702e60c5325da15
Verdict:
Malicious
File Type:
hta
First seen:
2026-04-08T14:12:00Z UTC
Last seen:
2026-04-11T00:30:00Z UTC
Hits:
~10
Detections:
PDM:Trojan.Win32.Generic PDM:Exploit.Win32.Generic Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/18996b3867667a26d543360de3aa752679fa2b91c96539cfe702e60c5325da15/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1895696
Signature
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1895696 Sample: MaybeWorking.hta Startdate: 09/04/2026 Architecture: WINDOWS Score: 88 31 raw.githubusercontent.com 2->31 33 Malicious sample detected (through community Yara rule) 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet 2->37 39 5 other signatures 2->39 8 mshta.exe 1 2->8         started        11 svchost.exe 1 1 2->11         started        signatures3 process4 signatures5 41 Suspicious powershell command line found 8->41 13 powershell.exe 15 8->13         started        16 curl.exe 2 8->16         started        19 powershell.exe 11 8->19         started        process6 dnsIp7 43 Found suspicious powershell code related to unpacking or dynamic code loading 13->43 21 conhost.exe 13->21         started        27 raw.githubusercontent.com 185.199.108.133, 443, 49683 FASTLYUS Netherlands 16->27 29 127.0.0.1 unknown unknown 16->29 23 conhost.exe 16->23         started        25 conhost.exe 19->25         started        signatures8 process9
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/18996b3867667a26d543360de3aa752679fa2b91c96539cfe702e60c5325da15
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18996b3867667a26d543360de3aa752679fa2b91c96539cfe702e60c5325da15/
Verdict:
Malicious
Threat:
Trojan.JS.SAgent
Link:
https://tip.neiki.dev/file/18996b3867667a26d543360de3aa752679fa2b91c96539cfe702e60c5325da15
Threat name:
Script-WScript.Trojan.Electryon
Create hunting rule
Status:
Malicious
First seen:
2026-04-08 01:41:19 UTC
File Type:
Text (VBS)
AV detection:
12 of 37 (32.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dcmwwodhmz5cnvkdgyg6hktvez47uk4rzfsttt7haltayuzf3ikq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/260409-g8kbgact9y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Contacts third-party web service commonly abused for C2
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/18996b3867667a26d543360de3aa752679fa2b91c96539cfe702e60c5325da15

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HTML Application (hta) hta 18996b3867667a26d543360de3aa752679fa2b91c96539cfe702e60c5325da15

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3814746/
  
Delivery method
Distributed via web download

Comments