MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18c4d384f8fef858accb57fff9dc4036bf52a051b249696b657162b1adcbf104. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	18c4d384f8fef858accb57fff9dc4036bf52a051b249696b657162b1adcbf104
SHA3-384 hash:	60eebc4b42daa2a764530f84a6ea8147f16365de4cb3c4884d5b48e273c6e4bb866ebe3ad59742ba3d2f8c88fa9751de
SHA1 hash:	eb3538dfb14f24d20974635cf2822329e8851b0d
MD5 hash:	bd8bd746b35be94eb0223a24793c8b7b
humanhash:	crazy-nineteen-uncle-glucose
File name:	Звернення народного депутата Верховної Ради України IX скликання 11-2967-25_23.09.2025.HTA
Download:	download sample
Signature	Gamaredon Alert Create hunting rule
File size:	4'506 bytes
First seen:	2025-10-06 20:55:46 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	48:tRuqxA+BriT08zQ6Eng0RK2S7ffUNyUDaDJVl1qcVyjiBS9LWfCKTjnVL/znSJC7:bfA+go8X0s2S7fcNiP1qcVMXuPhz/yer
TLSH	T1CB911F9FD90F1C9B43086AA1D0FF18C35BA04110AA76838D7971630991E496C7FEB27F
Magika	html
Reporter	smica83
Tags:	apt gamaredon hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

49

Origin country :

HU

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68e42cd77f305fa2545d05e3

Tags:

philis trojan hello

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/18c4d384f8fef858accb57fff9dc4036bf52a051b249696b657162b1adcbf104/results/dashboard

Behaviour

BlacklistAPI detected

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/18c4d384f8fef858accb57fff9dc4036bf52a051b249696b657162b1adcbf104

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2025-09-23T19:20:00Z UTC

Last seen:

2025-09-23T19:52:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/18c4d384f8fef858accb57fff9dc4036bf52a051b249696b657162b1adcbf104/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1790215

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

6%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/18c4d384f8fef858accb57fff9dc4036bf52a051b249696b657162b1adcbf104

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Html

Link:

https://app.malva.re/file/bd8bd746b35be94eb0223a24793c8b7b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/18c4d384f8fef858accb57fff9dc4036bf52a051b249696b657162b1adcbf104/

Neiki Trojan.Win32.Agent

Verdict:

Malicious

Threat:

Trojan.Win32.Agent

Link:

https://tip.neiki.dev/file/18c4d384f8fef858accb57fff9dc4036bf52a051b249696b657162b1adcbf104

ReversingLabs TitaniumCloud Win32.Trojan.Egairtigado

Threat name:

Win32.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-09-23 17:21:27 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ddcnhbhy734frlglk777txcag27vficrwjews23fofrldlol6eca._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery

Link:

https://tria.ge/reports/251006-zqw7esfl5w/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Checks computer location settings

Badlisted process makes network request

Malware Config

Dropper Extraction:

http://www.golosameriki.com@open-pdf.serveftp.com/motherrDJ/ssu/flowerbedD6M/dressmakerpvv.pdf

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/18c4d384f8fef858accb57fff9dc4036bf52a051b249696b657162b1adcbf104