MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22b64786cee07bd4e8b11503da27ae4f56edff35b3d32716ddb4f8aabedccdd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	22b64786cee07bd4e8b11503da27ae4f56edff35b3d32716ddb4f8aabedccdd5
SHA3-384 hash:	fba6704d33e29c9671b94687b750066f580aa47a905fca518db6666bacc796c3cf70941141863939975176320448dd84
SHA1 hash:	b5551e46b6bbfc9e3d031dfed1285f23afae807d
MD5 hash:	18b45ada38bafd387af968ee10ee74cb
humanhash:	steak-georgia-cardinal-failed
File name:	e-dekont.pdf.hta
Download:	download sample
File size:	435'042 bytes
First seen:	2026-07-02 14:56:10 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	192:Fp2tymh7QsAsHBpuK2hcUcC28DmI7w6sAUh7y+Vv0F5Wlmn/57vfqR7XdKdeHQqq:F4CM+X5X
TLSH	T16E942044C7D6050E14A6748486F2DACC58EC767BEFB7EDA0F91526FEAA39E70403E058
Magika	html
Reporter	lowmal3
Tags:	hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

61

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.HTML.HideMe-22.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a467c257ebb079b692bc5b0

Tags:

n/a

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/22b64786cee07bd4e8b11503da27ae4f56edff35b3d32716ddb4f8aabedccdd5/results/dashboard

Payload URLs

URL

File name

winmgmts:\\\\.\\roᒲ

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 fingerprint masquerade powershell

Link:

https://www.filescan.io/uploads/6a467c1c2df5dd570cfc5114/reports/c32f7064-8baf-4688-8d1f-1f9bbc836002/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/22b64786cee07bd4e8b11503da27ae4f56edff35b3d32716ddb4f8aabedccdd5

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-07-01T07:57:00Z UTC

Last seen:

2026-07-04T03:52:00Z UTC

Hits:

~1000

Detections:

Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/22b64786cee07bd4e8b11503da27ae4f56edff35b3d32716ddb4f8aabedccdd5/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1936816

Signature

Antivirus detection for URL or domain

Creates processes via WMI

Detected large data written to user environment variables, potentially indicating payload staging for fileless execution

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

94%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/22b64786cee07bd4e8b11503da27ae4f56edff35b3d32716ddb4f8aabedccdd5

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/18b45ada38bafd387af968ee10ee74cb

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/22b64786cee07bd4e8b11503da27ae4f56edff35b3d32716ddb4f8aabedccdd5/

Neiki Trojan.JS.SAgent

Verdict:

Malicious

Threat:

Trojan.JS.SAgent

Link:

https://tip.neiki.dev/file/22b64786cee07bd4e8b11503da27ae4f56edff35b3d32716ddb4f8aabedccdd5

ReversingLabs TitaniumCloud Win32.Trojan.Kepavll

Threat name:

Win32.Trojan.Kepavll

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-01 11:01:00 UTC

File Type:

Binary

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ek3epbwo4b55j2frcub5uj5oj5lo37zvwpjsofw5wt4kvpw4zxkq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

adware discovery execution persistence ransomware spyware

Link:

https://tria.ge/reports/260702-sa9dgsgv7y/

Behaviour

Checks SCSI registry key(s)

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

System Location Discovery: System Language Discovery

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.10

Link:

https://yomi.yoroi.company/submissions/22b64786cee07bd4e8b11503da27ae4f56edff35b3d32716ddb4f8aabedccdd5