MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f9abffd3050fea4494ea58d6c15b4fcd1a0430cd3c7d9c8f633379a70f16417. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3f9abffd3050fea4494ea58d6c15b4fcd1a0430cd3c7d9c8f633379a70f16417
SHA3-384 hash:	010a9afcf716976b07d159270a6619cf1c78ee70d70e24434a95acb581a48b7709bc741e0f5c1d98090ab87f6ad45096
SHA1 hash:	dfd5a2206238602bd6273a851760ce9bb8e401c7
MD5 hash:	7cf9e5365d7cdcf0f44dafffbd088d3c
humanhash:	texas-california-eight-nevada
File name:	9d8fds9f9dsf9f9398gf98h9f9g8h9h8349899h9fg9h8989589945988f9g8h98f9hg99h89f8hf9g8h989.hta
Download:	download sample
File size:	72'780 bytes
First seen:	2025-11-20 15:23:56 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	192:BpMhCQ0hRSk2SlF1pchRF4WULhKhfChkhlD2Wyaz0Jw6y:oop6tIFYzF4bI9CCHD2s6y
TLSH	T1966308C2119FD206AE8B15D14FB2363DA843CECA1B5DA7858DC6211FFB082A5957CE1F
Magika	html
Reporter	juroots
Tags:	hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

39

Origin country :

IL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.68556931.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=691f087f4917b5d23dafb2f6

Tags:

obfuscate xtreme spawn

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/3f9abffd3050fea4494ea58d6c15b4fcd1a0430cd3c7d9c8f633379a70f16417/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 obfuscated powershell

Link:

https://www.filescan.io/uploads/691f32c81c724c5c1c704c27/reports/edaccbbf-a86f-4c07-9eec-ac79a3117826/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3f9abffd3050fea4494ea58d6c15b4fcd1a0430cd3c7d9c8f633379a70f16417

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2025-11-19T09:54:00Z UTC

Last seen:

2025-11-22T10:18:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/3f9abffd3050fea4494ea58d6c15b4fcd1a0430cd3c7d9c8f633379a70f16417/results?tab=lookup

Nucleon Malprob Malware

Score:

90%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/3f9abffd3050fea4494ea58d6c15b4fcd1a0430cd3c7d9c8f633379a70f16417

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/7cf9e5365d7cdcf0f44dafffbd088d3c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3f9abffd3050fea4494ea58d6c15b4fcd1a0430cd3c7d9c8f633379a70f16417/

Neiki Trojan-Downloader.JS.SLoad

Verdict:

Malicious

Threat:

Trojan-Downloader.JS.SLoad

Link:

https://tip.neiki.dev/file/3f9abffd3050fea4494ea58d6c15b4fcd1a0430cd3c7d9c8f633379a70f16417

ReversingLabs TitaniumCloud Script-JS.Trojan.Xloader

Threat name:

Script-JS.Trojan.Xloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-19 12:54:49 UTC

File Type:

Binary

AV detection:

7 of 36 (19.44%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h6nl77jqkd7kiskouwgwyfnu7ti2aqym2pd5tshwgm3zu4hrmqlq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution

Link:

https://tria.ge/reports/251120-stbasswpdv/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Checks computer location settings

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Malware Config

Dropper Extraction:

https://archive.org/download/optimized_msi_20251119/optimized_MSI.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/3f9abffd3050fea4494ea58d6c15b4fcd1a0430cd3c7d9c8f633379a70f16417