MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f3c811e542fc56d00a8fa94afa370068f786725e835fbbb5442713293d2a381. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1f3c811e542fc56d00a8fa94afa370068f786725e835fbbb5442713293d2a381
SHA3-384 hash:	cb9dedc533e3a041a245559afa16bca3f8bfe4e7e238cbd4f74ca5c679328d23ab1a4837b8cb0f8116473bfd7e0363b7
SHA1 hash:	3e2d4749892494ce8b634e4f9f2cdd165ab51f37
MD5 hash:	77db8fd951b0c374a307cd6de691ebd5
humanhash:	kansas-romeo-cola-early
File name:	givingbesthingsforbetterforme.hta
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	14'920 bytes
First seen:	2026-08-13 12:11:16 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	48:3Qi1C4/3ii14R4/3PHqrcuuuuuuuuuscFC0uuL6grwtX1amuuuuuFuuuM0VLi1ti:AaziajirycFCqwaeLaRag0Yaw+
TLSH	T1FA62633D4B34E8C540BAB1BCA4A01C1331C0DA3F85349C05FC2C593387A2ACE9E29599
Magika	txt
Reporter	James_inthe_box
Tags:	AgentTesla exe hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

116

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.55333377.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.VBS.Obfuscated-IO.49936164.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/1f3c811e542fc56d00a8fa94afa370068f786725e835fbbb5442713293d2a381/results/dashboard

Payload URLs

URL

File name

http://209.54.103.153/50/weneedbestthingsfromtheheartforbest.js

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

powershell

Link:

https://www.filescan.io/uploads/6a7db475307f3017a896033b/reports/d3284517-64d9-47f3-91be-3545c6687c89/overview

Hybrid Analysis VBS.Asthma.2.9C69FC49

Verdict:

Malicious

Labled as:

VBS.Asthma.2.9C69FC49

Link:

https://www.hybrid-analysis.com/sample/1f3c811e542fc56d00a8fa94afa370068f786725e835fbbb5442713293d2a381

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

html

First seen:

2026-08-13T10:13:00Z UTC

Last seen:

2026-08-14T02:49:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/1f3c811e542fc56d00a8fa94afa370068f786725e835fbbb5442713293d2a381/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1f3c811e542fc56d00a8fa94afa370068f786725e835fbbb5442713293d2a381

Malva.RE Malware

Verdict:

Malware

YARA:

3 match(es)

Tags:

Base64 Block Contains Base64 Block DeObfuscated Html PowerShell T1027 T1059.001

Link:

https://app.malva.re/file/77db8fd951b0c374a307cd6de691ebd5

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/1f3c811e542fc56d00a8fa94afa370068f786725e835fbbb5442713293d2a381/

ReversingLabs TitaniumCloud Script-WScript.Dropper.Asthma

Threat name:

Script-WScript.Dropper.Asthma

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-13 11:13:04 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

9 of 36 (25.00%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d46ichsuf7cw2afi7kkk7i3qa2hxqzzf5a27xo2uijytfe6suoaq._file

Threatray AgentTesla

Verdict:

malicious

Label(s):

AgentTesla

Alert

Create hunting rule

Link:

https://reports.threatray.com/e1e141e4-0802-4e45-9375-ab1b2f273cc9

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260813-pcwnmax1ax/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Checks computer location settings

Badlisted process makes network request

VMRay DonutLoader

Malware family:

DonutLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1f3c811e542f/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1f3c811e542fc56d00a8fa94afa370068f786725e835fbbb5442713293d2a381