MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 326aa08fc6383682549ddac7f9a77fd8054df32a482e5123e3b788f0855596ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 326aa08fc6383682549ddac7f9a77fd8054df32a482e5123e3b788f0855596ec
SHA3-384 hash: c30264c94f0d33666c642b4b68346ff627c4d67ac073694644a5c9262b55640e0c1581bbe05d8ab3c97c2275015199f0
SHA1 hash: d08a43f322d60ff15b3aa6835870f67681707517
MD5 hash: a8f9d2861f5a5dae7afffd1d97edad4e
humanhash: eleven-crazy-maryland-massachusetts
File name:fuck_niggers_49.hta
Download: download sample
File size:497 bytes
First seen:2025-05-18 16:13:10 UTC
Last seen:Never
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 12:kxvsCk9cE3Mod/XUJpqJrU22ic/BscB/HNYI:kbxu/kJpA2rBHfCI
TLSH T1C4F00EFB5C9BCD0CE7802C484FA552A4698906A91189D82C82E99C31383224FAE09464
Magika javascript
Reporter abuse_ch
Tags:hta

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Redir-262.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=682a09c8375681df7c1a52c4
Tags:
n/a
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/326aa08fc6383682549ddac7f9a77fd8054df32a482e5123e3b788f0855596ec/results/dashboard
Payload URLs
URL
File name
https://daftar.site/7CCI/fuck_niggers_49.hta?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc0NzU5MTY5MiwiaWF0IjoxNzQ3NTg0NDkyLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMTBhbGxpbnJsMGg1bTE3NTQwOGlja2wiLCJuYmYiOjE3NDc1ODQ0OTIsInRzIjoxNzQ3NTg0NDkyOTkzNTYwfQ.72oRrFcB188X-5OfH7fAz3L9A6aTX2KP4t7-QSyf5Qg&sid=4cb3f656-3402-11f0-9951-2a3cbd3f8f18');
HTA File
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 obfuscated
Link:
https://www.filescan.io/uploads/682a0756bff72ff46b65cc17/reports/d5edfe86-41c6-4ecc-896f-a88df776d1fc/overview
Verdict:
Malicious
Labled as:
JS/Redirector.QNO trojan
Link:
https://www.hybrid-analysis.com/sample/326aa08fc6383682549ddac7f9a77fd8054df32a482e5123e3b788f0855596ec
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1693413
Signature
Antivirus detection for URL or domain
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1693413 Sample: fuck_niggers_49.hta Startdate: 18/05/2025 Architecture: WINDOWS Score: 48 19 ww3.daftar.site 2->19 21 obseu.astarsbuilding.com 2->21 23 5 other IPs or domains 2->23 31 Antivirus detection for URL or domain 2->31 8 iexplore.exe 71 74 2->8         started        10 mshta.exe 2->10         started        signatures3 process4 process5 12 iexplore.exe 23 8->12         started        15 iexplore.exe 8 8->15         started        dnsIp6 25 c.parkingcrew.net 185.53.178.30, 49723, 49724, 80 TEAMINTERNET-ASDE Germany 12->25 27 euob.astarsbuilding.com 18.164.154.64, 443, 49719, 49720 MIT-GATEWAYSUS United States 12->27 29 3 other IPs or domains 12->29 17 ssvagent.exe 501 15->17         started        process7
Score:
1%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/326aa08fc6383682549ddac7f9a77fd8054df32a482e5123e3b788f0855596ec
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/326aa08fc6383682549ddac7f9a77fd8054df32a482e5123e3b788f0855596ec/
Threat name:
Script-JS.Trojan.Redirector
Create hunting rule
Status:
Malicious
First seen:
2025-05-18 16:14:15 UTC
File Type:
Text (HTML)
Extracted files:
1
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gjvkbd6gha3ieve53ld7tj373acu34zkjaxfci7dw6epbbkvs3wa._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
defense_evasion discovery trojan
Link:
https://tria.ge/reports/250518-tpm98sgr3x/
Behaviour
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Checks whether UAC is enabled
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/326aa08fc6383682549ddac7f9a77fd8054df32a482e5123e3b788f0855596ec

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HTML Application (hta) hta 326aa08fc6383682549ddac7f9a77fd8054df32a482e5123e3b788f0855596ec

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1904456/
  
Delivery method
Distributed via web download

Comments