MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c41b7dd5914336764151dddb1ea7f5240c4bb9ec5590d3eb6e5c589c588dfad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2c41b7dd5914336764151dddb1ea7f5240c4bb9ec5590d3eb6e5c589c588dfad
SHA3-384 hash:	431a912852181679bb66234b6d0471d33128a322378cfa2af6f64b539a2d8a80e4d6ea693e69ee8e6f98db0b35ebb36b
SHA1 hash:	17a0c9854f5c64551eba0bfcccdcde8b1e0c02c0
MD5 hash:	067f533104019bf53599b0408e0c36fc
humanhash:	california-sink-autumn-cardinal
File name:	107.173.227.126_90_bestwishes.hta
Download:	download sample
File size:	445'742 bytes
First seen:	2026-10-14 15:17:42 UTC
Last seen:	Never
File type:	hta
MIME type:	application/hta
ssdeep	3072:x/y7GVbdsmCu8E1EUy4Cp7Ex6Uxbym8UENs7WBGC0C2C9CAiQsfJcRCJYJwV8FQu:E
TLSH	T12B94C60253EA0648F3B25F8A6E7744690A777D939D3E915C129CA01A1FF3A44CD72BB3
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	html
Reporter	TomU
Tags:	hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

87

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.HTML.HideMe-22.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad14cb3f4e17c78f715f93b

Tags:

virus hype sage

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/2c41b7dd5914336764151dddb1ea7f5240c4bb9ec5590d3eb6e5c589c588dfad/results/dashboard

Payload URLs

URL

File name

http://107.173.227.126/2M93UZZz

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6acf9d3fd3bae837b818b5e4/reports/1479e18d-755b-4c31-a0ab-63cde65b255c/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2c41b7dd5914336764151dddb1ea7f5240c4bb9ec5590d3eb6e5c589c588dfad

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-09-18T03:29:00Z UTC

Last seen:

2026-10-14T13:55:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/2c41b7dd5914336764151dddb1ea7f5240c4bb9ec5590d3eb6e5c589c588dfad/results?tab=lookup

Nucleon Malprob Malware

Score:

89%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2c41b7dd5914336764151dddb1ea7f5240c4bb9ec5590d3eb6e5c589c588dfad

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Html

Link:

https://app.malva.re/file/067f533104019bf53599b0408e0c36fc

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2c41b7dd5914336764151dddb1ea7f5240c4bb9ec5590d3eb6e5c589c588dfad/

ReversingLabs TitaniumCloud Script-JS.Trojan.LausivLoader

Threat name:

Script-JS.Trojan.LausivLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-17 09:31:35 UTC

File Type:

Text (JavaScript)

AV detection:

13 of 38 (34.21%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fra3pxkzcqzwozavdxo3d2t7kjamjo46yvmq2pvw4xcytrmi36wq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery

Link:

https://tria.ge/reports/261014-spsdhsw1gz/

Behaviour

Script User-Agent

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/2c41b7dd5914336764151dddb1ea7f5240c4bb9ec5590d3eb6e5c589c588dfad