MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65e7379384f0debbb9dab01c7c3f9764d1f878b39ec3546ab273ca1d4730fafc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	65e7379384f0debbb9dab01c7c3f9764d1f878b39ec3546ab273ca1d4730fafc
SHA3-384 hash:	149e9e8aee6f9449c93f6886acc18f1daba25326eef25ac44562495f34588426f39adea0b61ee37941cba1ba24b6cb7e
SHA1 hash:	f0865239f68b68c470d37dacd2a252d8fe30838f
MD5 hash:	7c67297f0ea9fdbce5e3b5208fc3951e
humanhash:	earth-magazine-maine-island
File name:	gg2.hta
Download:	download sample
File size:	182 bytes
First seen:	2025-09-01 08:05:36 UTC
Last seen:	2025-09-02 07:06:06 UTC
File type:	hta
MIME type:	text/html
ssdeep	3:qVZx/XMnkAqRAdu6/GY7voOn3ySLFTrHGaR5NWVAUMT/XJURVPR8TbDEHeZNp79c:qzx/XnAqJm79RLhrHvNWVb8hURlST/uL
TLSH	T17CC080DF8C91D44289D0F4C0EAF0DA254457D5C95541DC51BCC0463574403D66D5A5E6
Magika	html
Reporter	abuse_ch
Tags:	hta

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

49

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68b553d9eb163e0ec183eb29

Tags:

n/a

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

HTA File

Link:

https://app.docguard.net/65e7379384f0debbb9dab01c7c3f9764d1f878b39ec3546ab273ca1d4730fafc/results/dashboard

Payload URLs

URL

File name

https://www.calix.ai/web/blockpage/index.html?spid=OkKB7ElomO&t=3&url=http://8.134.74.227/gg2.hta

HTA File

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/65e7379384f0debbb9dab01c7c3f9764d1f878b39ec3546ab273ca1d4730fafc

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

html

Link:

https://opentip.kaspersky.com/65e7379384f0debbb9dab01c7c3f9764d1f878b39ec3546ab273ca1d4730fafc/results?tab=lookup

Joe Sandbox clean

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

1 / 100

Link:

https://www.joesandbox.com/analysis/1768733

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/65e7379384f0debbb9dab01c7c3f9764d1f878b39ec3546ab273ca1d4730fafc

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/7c67297f0ea9fdbce5e3b5208fc3951e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/65e7379384f0debbb9dab01c7c3f9764d1f878b39ec3546ab273ca1d4730fafc/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mxttpe4e6dplxoo2waohyp4xmti7q6ftt3bvi2vsopfb2rzq7l6a._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

adware defense_evasion discovery persistence ransomware spyware stealer trojan

Link:

https://tria.ge/reports/250901-jy8messrx3/

Behaviour

Modifies Internet Explorer settings

Modifies Internet Explorer start page

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

System Location Discovery: System Language Discovery

Checks whether UAC is enabled

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/65e7379384f0debbb9dab01c7c3f9764d1f878b39ec3546ab273ca1d4730fafc