MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23ca0c502a80d68372e118dac850f68c35aabc19bd460101fe9db8a3c0cfd58d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23ca0c502a80d68372e118dac850f68c35aabc19bd460101fe9db8a3c0cfd58d
SHA3-384 hash: 71baadc9a5a4a926832968361c24ad764fe347d10f37206de7251268e5ed8387f36cfc35ccdec1970db664cf392a5724
SHA1 hash: d0d23351d1148cc31bf56e60aa1d6e3362f9d9cf
MD5 hash: c4dbb390f1f6be2db5e63378cc077176
humanhash: florida-princess-september-dakota
File name:fuck_niggers_49.hta
Download: download sample
File size:497 bytes
First seen:2025-05-18 11:42:57 UTC
Last seen:Never
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 12:kxvsCk9cE3Mod/XUQsJeB2MeduUQfMXHVYI:kbxu/kCEdvBKI
TLSH T1C5F054AB2C87E90D77402F85CF8952D899C8419610A8D81DD0EC5CBCB83EE7E9F06068
Magika javascript
Reporter abuse_ch
Tags:hta

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Redir-262.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6829c7d0e5aa44ec2e1a7379
Tags:
blic sage hype
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/23ca0c502a80d68372e118dac850f68c35aabc19bd460101fe9db8a3c0cfd58d/results/dashboard
Payload URLs
URL
File name
https://daftar.site/7CCI/fuck_niggers_49.hta?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc0NzU3NTQxNiwiaWF0IjoxNzQ3NTY4MjE2LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMTA5bzI0azE0M29xMDFuMTgxM21xMDciLCJuYmYiOjE3NDc1NjgyMTYsInRzIjoxNzQ3NTY4MjE2MDc3MDA2fQ.1LIy5Ogmim9xWXMP7WnWGnu4YFXx8NnxgMY5PRQ1y9Q&sid=66e797d2-33dc-11f0-8ae5-416bc34e44a6');
HTA File
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 obfuscated
Link:
https://www.filescan.io/uploads/6829c7ce0de036ed65aae735/reports/7f878042-3a68-444e-826c-6acadd3db6b0/overview
Verdict:
Malicious
Labled as:
JS/Redirector.QNO trojan
Link:
https://www.hybrid-analysis.com/sample/23ca0c502a80d68372e118dac850f68c35aabc19bd460101fe9db8a3c0cfd58d
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1693332
Signature
Antivirus detection for URL or domain
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1693332 Sample: fuck_niggers_49.hta Startdate: 18/05/2025 Architecture: WINDOWS Score: 48 19 ww3.daftar.site 2->19 21 obseu.astarsbuilding.com 2->21 23 5 other IPs or domains 2->23 31 Antivirus detection for URL or domain 2->31 8 iexplore.exe 70 74 2->8         started        10 mshta.exe 2->10         started        signatures3 process4 process5 12 iexplore.exe 24 8->12         started        15 iexplore.exe 8 8->15         started        dnsIp6 25 c.parkingcrew.net 185.53.178.30, 49698, 49699, 80 TEAMINTERNET-ASDE Germany 12->25 27 euob.astarsbuilding.com 18.164.154.102, 443, 49696, 49697 MIT-GATEWAYSUS United States 12->27 29 3 other IPs or domains 12->29 17 ssvagent.exe 501 15->17         started        process7
Score:
1%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/23ca0c502a80d68372e118dac850f68c35aabc19bd460101fe9db8a3c0cfd58d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/23ca0c502a80d68372e118dac850f68c35aabc19bd460101fe9db8a3c0cfd58d/
Threat name:
Script-JS.Trojan.Redirector
Create hunting rule
Status:
Malicious
First seen:
2025-05-18 11:43:12 UTC
File Type:
Text (HTML)
Extracted files:
1
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=epfayubkqdlig4xbddnmquhwrq22vpazxvdacap6tw4khqgp2wgq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
defense_evasion discovery trojan
Link:
https://tria.ge/reports/250518-nvl2gacq5y/
Behaviour
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Checks whether UAC is enabled
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/23ca0c502a80d68372e118dac850f68c35aabc19bd460101fe9db8a3c0cfd58d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HTML Application (hta) hta 23ca0c502a80d68372e118dac850f68c35aabc19bd460101fe9db8a3c0cfd58d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1904456/
  
Delivery method
Distributed via web download

Comments