MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87bf38966f61d31d3e2fcd1362ddc959fe5006e0c2cefdc72ccbed21569553af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	87bf38966f61d31d3e2fcd1362ddc959fe5006e0c2cefdc72ccbed21569553af
SHA3-384 hash:	89e6d6f1440767d74e98f9c4687335d6601d2e423dea1a7c94c28b4e6b4da18399c1401cadc6ef642e8faad5d4383b8c
SHA1 hash:	a68e5cfcb536c87f89151726535976a01d747ae0
MD5 hash:	df4b357889b010f3cd913cca04e990e9
humanhash:	green-timing-low-berlin
File name:	107.172.172.220_50_wearegood.hta
Download:	download sample
File size:	421'756 bytes
First seen:	2026-10-14 15:16:12 UTC
Last seen:	Never
File type:	hta
MIME type:	application/hta
ssdeep	3072:957/Q/yHhCKPwKxlp8Cggd9l5+fMEXQpdazRuwUfCdFnsT6q5UU8WfDVOH:U
TLSH	T1F994E34352EA0A98F2F31F89697752660E377D51AC3D821D619CE00D4BE3E85CDB1BA3
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	html
Reporter	TomU
Tags:	hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

63

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.HTML.HideMe-22.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad14a9b6f551121ba165920

Tags:

muldrop virus sage

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/87bf38966f61d31d3e2fcd1362ddc959fe5006e0c2cefdc72ccbed21569553af/results/dashboard

Payload URLs

URL

File name

http://204.44.93.73/IdFfAFA7

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6acf9cdbd3bae837b818b2f2/reports/e735bce1-03ac-4dc5-aa7f-f76f3051ec26/overview

Hybrid Analysis Trojan.Formbook.JS

Verdict:

Malicious

Labled as:

Trojan.Formbook.JS

Link:

https://www.hybrid-analysis.com/sample/87bf38966f61d31d3e2fcd1362ddc959fe5006e0c2cefdc72ccbed21569553af

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-10-14T13:40:00Z UTC

Last seen:

2026-10-14T13:48:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/87bf38966f61d31d3e2fcd1362ddc959fe5006e0c2cefdc72ccbed21569553af/results?tab=lookup

Nucleon Malprob Malware

Score:

92%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/87bf38966f61d31d3e2fcd1362ddc959fe5006e0c2cefdc72ccbed21569553af

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/df4b357889b010f3cd913cca04e990e9

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/87bf38966f61d31d3e2fcd1362ddc959fe5006e0c2cefdc72ccbed21569553af/

ReversingLabs TitaniumCloud Script-JS.Trojan.LausivLoader

Threat name:

Script-JS.Trojan.LausivLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-15 03:29:47 UTC

File Type:

Text (JavaScript)

AV detection:

10 of 23 (43.48%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=q67trftpmhjr2prpzujwfxojlh7fabxaylhp3rzmzpwscvuvkoxq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery

Link:

https://tria.ge/reports/261014-snnc6stx7m/

Behaviour

Script User-Agent

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/87bf38966f61d31d3e2fcd1362ddc959fe5006e0c2cefdc72ccbed21569553af