MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5eb4973ce58ca8d691309fe57959dfb2f43d9f9cb4e094b23b6aa0ff173bb12a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5eb4973ce58ca8d691309fe57959dfb2f43d9f9cb4e094b23b6aa0ff173bb12a
SHA3-384 hash:	ed0828e7394a9f3ed76d73892fba08de4377e249adb9a53407d7e76fc6ad9bc6a8c31ea01815796d48cb655f1ca85041
SHA1 hash:	0f127991dc86f591985e92aaf54ccc80b9084c0d
MD5 hash:	520b652b9f629a1b6065c94f19ea792e
humanhash:	green-music-red-river
File name:	mob44532190.pdf.hta
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	2'591'256 bytes
First seen:	2026-07-20 13:54:47 UTC
Last seen:	Never
File type:	hta
MIME type:	text/plain
ssdeep	384:oA9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9A9r:IK
TLSH	T106C51343D6B0CEB5928C0698E91ED6D9DB60B2317FB59C2B341543BEDBC454423A8BF8
Magika	javascript
Reporter	lowmal3
Tags:	hta MassLogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

85

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.HTML.HideMe-22.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5e2dadbcffb2c48cb7a246

Tags:

stration shell spawn

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/5eb4973ce58ca8d691309fe57959dfb2f43d9f9cb4e094b23b6aa0ff173bb12a/results/dashboard

Payload URLs

URL

File name

https://misty-cherry-cea3.uploadsimg.workers.dev/Rvidm

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

masquerade repaired

Link:

https://www.filescan.io/uploads/6a5e2d9975e18dcb03f0744a/reports/0ed6f945-f64a-4412-be55-8e4d6917bcf0/overview

Hybrid Analysis JS/Agent.ENP

Verdict:

Suspicious

Labled as:

JS/Agent.ENP

Link:

https://www.hybrid-analysis.com/sample/5eb4973ce58ca8d691309fe57959dfb2f43d9f9cb4e094b23b6aa0ff173bb12a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-07-20T08:51:00Z UTC

Last seen:

2026-07-21T11:06:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/5eb4973ce58ca8d691309fe57959dfb2f43d9f9cb4e094b23b6aa0ff173bb12a/results?tab=lookup

Joe Sandbox MSIL Logger, MassLogger RAT

Result

Threat name:

MSIL Logger, MassLogger RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1945262

Signature

Antivirus detection for URL or domain

Creates processes via WMI

Detected large data written to user environment variables, potentially indicating payload staging for fileless execution

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Sigma detected: Suspicious MSHTA Child Process

Suricata IDS alerts for network traffic

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Powershell decode and execute

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

22%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/5eb4973ce58ca8d691309fe57959dfb2f43d9f9cb4e094b23b6aa0ff173bb12a

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/520b652b9f629a1b6065c94f19ea792e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5eb4973ce58ca8d691309fe57959dfb2f43d9f9cb4e094b23b6aa0ff173bb12a/

ReversingLabs TitaniumCloud Script-JS.Trojan.Generic

Threat name:

Script-JS.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-07-20 14:16:06 UTC

File Type:

Binary

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=l22jophfrsunnejqt7sxswo7wl2d3h44wtqjjmr3nkqp6fz3weva._file

Threatray NovaStealer

Verdict:

malicious

Label(s):

NovaStealer

Alert

Create hunting rule

Link:

https://reports.threatray.com/79a373d3-2e7a-4ac5-9d80-62932c8d7a23

Hatching Triage masslogger

Result

Malware family:

masslogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:masslogger collection discovery execution spyware stealer

Link:

https://tria.ge/reports/260720-rk1cwscw7q/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Badlisted process makes network request

Family: MassLogger

Process spawned unexpected child process

VMRay MassLogger

Malware family:

MassLogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5eb4973ce58c/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5eb4973ce58ca8d691309fe57959dfb2f43d9f9cb4e094b23b6aa0ff173bb12a