MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 740996ca9fb8ddc413b105dccabeca54bfe749f0c2341d3eaeec18b371373317. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	740996ca9fb8ddc413b105dccabeca54bfe749f0c2341d3eaeec18b371373317
SHA3-384 hash:	b6d6a25c53b90e7f4b898a744307d311b519091a74fa6a8ff065c9ba4e4ff017a93670326cfdb38f0f19132f046d69ef
SHA1 hash:	f93bd491c45c2c3fd616d99fccb3cd67e48c8da3
MD5 hash:	fe75fe95942c4a50a4a1ccb99da3400c
humanhash:	carbon-monkey-don-minnesota
File name:	bestpeopleswithbestskillforthenewowrking.hta
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	15'768 bytes
First seen:	2025-05-19 17:28:22 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	192:/ckSgskSYBXkgt8VukSmHXkS/OHt0FkSAv:kkSgskSQXaVukSm3kSwEkSw
TLSH	T1CA6289ABD7BBBC86CC53FB2EB57C2724019C052ED8B9C8951A41700A94E435AE0F06CF
Magika	txt
Reporter	abuse_ch
Tags:	FormBook hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

84

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.10183.4266.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=682c325ac28c67d666423820

Tags:

shell virus sage

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/682b6a4ebff72ff46b665902/reports/2e89b86f-2438-479f-89d3-d49bcbe3943f/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/740996ca9fb8ddc413b105dccabeca54bfe749f0c2341d3eaeec18b371373317

Joe Sandbox Cobalt Strike

Result

Threat name:

Cobalt Strike

Alert

Create hunting rule

Detection:

malicious

Classification:

expl.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1694587

Signature

Detected Cobalt Strike Beacon

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Multi AV Scanner detection for submitted file

PowerShell case anomaly found

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Suspicious MSHTA Child Process

Suspicious command line found

Suspicious powershell command line found

Uses threadpools to delay analysis

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/740996ca9fb8ddc413b105dccabeca54bfe749f0c2341d3eaeec18b371373317

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/740996ca9fb8ddc413b105dccabeca54bfe749f0c2341d3eaeec18b371373317/

ReversingLabs TitaniumCloud Script-WScript.Downloader.Nemucod

Threat name:

Script-WScript.Downloader.Nemucod

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-16 14:25:00 UTC

File Type:

Text (JavaScript)

AV detection:

11 of 38 (28.95%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=oqeznsu7xdo4ie5raxomvpwkks76ospqyi2b2pvo5qmlg4jxgmlq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/740996ca9fb8ddc413b105dccabeca54bfe749f0c2341d3eaeec18b371373317