MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f7ea639407732dfdc8e9dc2de1eddff287a9934e244d11b060076ff4825f1c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2f7ea639407732dfdc8e9dc2de1eddff287a9934e244d11b060076ff4825f1c2
SHA3-384 hash:	20844263919c1fde0647bdd5a1eb01ae7cb32829b9cd26a5e53bf723eef2c45080701b23798e83705e5feb7abfed9a69
SHA1 hash:	bc9161f8915eff42130a023960fd444122455adb
MD5 hash:	713c7ea86f0f6138d2d70cea8a921393
humanhash:	berlin-violet-moon-speaker
File name:	952abcd7-56a6-429c-8360-c142a.hta
Download:	download sample
File size:	9'582 bytes
First seen:	2026-06-11 21:07:26 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	192:3aqwBGjGNygwY/bmoOGYLpf0Sx8KDvq2TOaetdZEBqIGKgRBJ:3axBGjGNjwY/bLk9f0SxRDvTOaetdZE8
TLSH	T17A12EAF16238B4AE032149ED3FADC48C5980F5A6A04C4E28FD4C774987A72B155F77AB
Magika	html
Reporter	johnk3r
Tags:	client08-com hta prohoster-caiao-com-br verimail-agrobrasilnegocios-com

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

72

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.75677459.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Script.SNH-gen.68965846.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Script.SNH-gen.73153835.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a2b239934eaf30d8ce4fba1

Tags:

shell sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

lolbin msiexec obfuscated

Link:

https://www.filescan.io/uploads/6a2b2394bf16337e43c2645e/reports/629fe3cf-973d-4124-8b1d-7e4fc93a476d/overview

Hybrid Analysis GT:VB.ObfDldr.31

Verdict:

Malicious

Labled as:

GT:VB.ObfDldr.31

Link:

https://www.hybrid-analysis.com/sample/2f7ea639407732dfdc8e9dc2de1eddff287a9934e244d11b060076ff4825f1c2

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-06-11T18:15:00Z UTC

Last seen:

2026-06-12T18:39:00Z UTC

Hits:

~10

Detections:

PDM:Trojan.Win32.Generic Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/2f7ea639407732dfdc8e9dc2de1eddff287a9934e244d11b060076ff4825f1c2/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1926894

Signature

Multi AV Scanner detection for submitted file

Sigma detected: Legitimate Application Dropped Script

Sigma detected: Suspicious MSHTA Child Process

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2f7ea639407732dfdc8e9dc2de1eddff287a9934e244d11b060076ff4825f1c2

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2f7ea639407732dfdc8e9dc2de1eddff287a9934e244d11b060076ff4825f1c2/

Neiki Trojan.JS.SAgent

Verdict:

Malicious

Threat:

Trojan.JS.SAgent

Link:

https://tip.neiki.dev/file/2f7ea639407732dfdc8e9dc2de1eddff287a9934e244d11b060076ff4825f1c2

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-06-11 21:08:35 UTC

File Type:

Text (VBS)

AV detection:

6 of 36 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f57kmokao4zn7xeotxbn4hw574uhvgju4jcncgygab3p6sbf6hba._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery

Link:

https://tria.ge/reports/260611-zy3deadw5z/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Checks computer location settings

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/2f7ea639407732dfdc8e9dc2de1eddff287a9934e244d11b060076ff4825f1c2