MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f628ec25633d4b9f1a50f958ac6abcd6f341942b6deebe23807d4a792c00ca5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2f628ec25633d4b9f1a50f958ac6abcd6f341942b6deebe23807d4a792c00ca5
SHA3-384 hash:	f36c1f563aeae7fd9353c556dc10bc0de8abb76187ee55f4f33db52af581adcd8cb53d07461d8f775e37bfcec74fe238
SHA1 hash:	860e8fb3209b2d22b49e9406d75fa964fbaff0dd
MD5 hash:	ecc61a8a37339882ec7b73b21983dd02
humanhash:	arkansas-two-idaho-quiet
File name:	wegood.jpg.hta
Download:	download sample
File size:	15'278 bytes
First seen:	2026-09-29 08:24:34 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	384:TXNHMa1hxg2M/NXcNnwNUKFRIEiifKNJPbNFEOr:T1M2FgNXquRVzfAZZpr
TLSH	T12C623951ADF7B35D0E9AF1BA547935ABB0FC8C439DB52F38FC5CA863191621129CC08A
Magika	html
Reporter	abuse_ch
Tags:	hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

65

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Agent.AKR.tr.14261.32012.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/2f628ec25633d4b9f1a50f958ac6abcd6f341942b6deebe23807d4a792c00ca5/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 masquerade obfuscated powershell.exe

Link:

https://www.filescan.io/uploads/6abb75ee50a66cb2d2f115fa/reports/d50fe2c5-b1d9-46f3-a514-a407811dfe50/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2f628ec25633d4b9f1a50f958ac6abcd6f341942b6deebe23807d4a792c00ca5

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-09-28T23:51:00Z UTC

Last seen:

2026-09-29T00:32:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/2f628ec25633d4b9f1a50f958ac6abcd6f341942b6deebe23807d4a792c00ca5/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1979342

Signature

Joe Sandbox ML detected suspicious sample

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: MSHTA Suspicious Execution 01

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Suricata IDS alerts for network traffic

Suspicious command line found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

91%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2f628ec25633d4b9f1a50f958ac6abcd6f341942b6deebe23807d4a792c00ca5

Malva.RE Malware

Verdict:

Malware

YARA:

3 match(es)

Tags:

Batch Command COM Behavior Trace DeObfuscated Html Obfuscated PowerShell PowerShell Call SOS: 0.26 T1027 T1059 T1059.001 T1059.005 VBScript WScript.Shell

Link:

https://app.malva.re/file/ecc61a8a37339882ec7b73b21983dd02

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2f628ec25633d4b9f1a50f958ac6abcd6f341942b6deebe23807d4a792c00ca5/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f5ri5qswgpklt4nfb6kyvrvlzvxtigkcw3poxyrya7kkpewabssq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

defense_evasion discovery execution

Link:

https://tria.ge/reports/260929-kbew9sxv5p/

Behaviour

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Enumerates connected drives

Checks computer location settings

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.