MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2cf2922d0df1857f9fe38b3ab7666f85f791e68ee648e3790630c7ac4136a978. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Intelligence 11 IOCs YARA 4 File information Comments

SHA256 hash:	2cf2922d0df1857f9fe38b3ab7666f85f791e68ee648e3790630c7ac4136a978
SHA3-384 hash:	81024aae8a297ae562947fe48407d3d905b3d039ae7d4790757cd03fa7054982d8c10a91023b317e8dd728a00f426e52
SHA1 hash:	4244b0cb3769be5f948cbcaf29fbd77dba414512
MD5 hash:	a0b04e318e2e152ffc1bf482facf5c05
humanhash:	island-winner-edward-xray
File name:	CV_israa_Jerusalem.hta
Download:	download sample
File size:	1'388 bytes
First seen:	2026-10-31 21:29:25 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	24:NJ2ZSvzdjrsDsKrxoivvFwelYAztdOJVpoYB3OHDkw/IHnVt5PllyiDWTMC6:7pvz4sZivdweqUtsJT4jp/WnVrrC6
TLSH	T1BF2186601E8E83ACC6EE137C5A48C260C4D7540C6315AB93719CC9423DA1696CFDD79C
Magika	html
Reporter	smica83
Tags:	APT-C-23 AridViper hta

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae65defb175ade21dcecc33

Tags:

shell agent sage

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/2cf2922d0df1857f9fe38b3ab7666f85f791e68ee648e3790630c7ac4136a978/results/dashboard

Payload URLs

URL

File name

http://104.238.57.241/content/CV_israa_Jerusalem.docx

HTA File

Behaviour

BlacklistAPI detected

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

dropper encrypted powershell

Link:

https://www.filescan.io/uploads/6ae65deca14e7bad7bd72ba1/reports/81969d31-20bb-4ee1-a871-59a435f8fbe7/overview

Verdict:

Malicious

Labled as:

TrojanDownloader/PS.NetLoader

Link:

https://www.hybrid-analysis.com/sample/2cf2922d0df1857f9fe38b3ab7666f85f791e68ee648e3790630c7ac4136a978

Verdict:

Malicious

File Type:

hta

First seen:

2026-04-26T08:30:00Z UTC

Last seen:

2026-11-01T19:34:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/2cf2922d0df1857f9fe38b3ab7666f85f791e68ee648e3790630c7ac4136a978/results?tab=lookup

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1995930

Signature

Bypasses PowerShell execution policy

Joe Sandbox ML detected suspicious sample

Powershell connects to network

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Behaviour

Behavior Graph:

Download SVG

Score:

95%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2cf2922d0df1857f9fe38b3ab7666f85f791e68ee648e3790630c7ac4136a978

Verdict:

Malware

YARA:

3 match(es)

Tags:

Html PowerShell T1059.001 T1105

Link:

https://app.malva.re/file/a0b04e318e2e152ffc1bf482facf5c05

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2cf2922d0df1857f9fe38b3ab7666f85f791e68ee648e3790630c7ac4136a978/

Threat name:

Text.Trojan.Generic

Status:

Suspicious

First seen:

2026-05-10 15:37:29 UTC

File Type:

Text (HTML)

Extracted files:

AV detection:

3 of 36 (8.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ftzjelin6gcx7h7drm5loztpqx3zdzuo4zeog6iggdd2yqjwvf4a._file

Result

Malware family:

n/a

Score:

10/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261031-1cmaqsgs2j/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Checks computer location settings

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Malware Config

Dropper Extraction:

http://104.238.57.241/content/slider.png

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/2cf2922d0df1857f9fe38b3ab7666f85f791e68ee648e3790630c7ac4136a978

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	MULTI_Malware_RemcosRAT_ForgeAuto_4785f0c3 Create hunting rule
Author:	Marjoriefort
Description:	Detects RemcosRAT (inconnu, etat binaire)

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)