MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f1a14fb20df465ce4946cf546dfd4ced1eba5b160c6f36e6bd7177901bc82a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8f1a14fb20df465ce4946cf546dfd4ced1eba5b160c6f36e6bd7177901bc82a9
SHA3-384 hash:	cc23096b8f1233ad67108e190ff7dfdc5888b9db6ea1638e7205978f6383fa1bfff084a26ee107d20d566158a7c841f1
SHA1 hash:	9f2b9e0dc6a6f130389e9b0560884225175db8d8
MD5 hash:	a0c51c8fb649e848ede220292d05b89f
humanhash:	november-jig-beryllium-fillet
File name:	JSload.hta
Download:	download sample
File size:	14'952 bytes
First seen:	2026-08-13 14:12:45 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	48:3/o52Jio5xEJYYPa95uuuugBJ+kQO4tKPpuuuuuuHto5Ro5fSIbJ/o5UG:PoQJiofEJRy96BR4ao7oFSMJ/op
TLSH	T1D36251BAAB38F5E0C2C7D4FC140E7CC6140CCA0BD124AE7E785D4537931862D8A2A06F
Magika	html
Reporter	abuse_ch
Tags:	hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

42

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.73564561.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Script.SNH-gen.11349432.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/8f1a14fb20df465ce4946cf546dfd4ced1eba5b160c6f36e6bd7177901bc82a9/results/dashboard

Payload URLs

URL

File name

http://209.54.103.153/40/goodthingsforbestfeelingsformebest.jS

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

powershell

Link:

https://www.filescan.io/uploads/6a7dd1027ed35e268e631116/reports/f8a1fe79-5aef-4059-bfa8-352a3a4e624c/overview

Hybrid Analysis VBS.Asthma.2.6E77F4FF

Verdict:

Malicious

Labled as:

VBS.Asthma.2.6E77F4FF

Link:

https://www.hybrid-analysis.com/sample/8f1a14fb20df465ce4946cf546dfd4ced1eba5b160c6f36e6bd7177901bc82a9

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

html

First seen:

2026-08-13T13:00:00Z UTC

Last seen:

2026-08-14T01:49:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/8f1a14fb20df465ce4946cf546dfd4ced1eba5b160c6f36e6bd7177901bc82a9/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1957632

Signature

Antivirus / Scanner detection for submitted sample

Encrypted powershell cmdline option found

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

PowerShell case anomaly found

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/8f1a14fb20df465ce4946cf546dfd4ced1eba5b160c6f36e6bd7177901bc82a9

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8f1a14fb20df465ce4946cf546dfd4ced1eba5b160c6f36e6bd7177901bc82a9/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Asthma

Threat name:

Script-WScript.Trojan.Asthma

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-13 14:13:35 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

10 of 23 (43.48%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=r4nbj6za35dfzzeunt2unx6uz3i6xjnrmddpg3tl24lxsan4qkuq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260813-rjlhca1hmg/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Checks computer location settings

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/8f1a14fb20df465ce4946cf546dfd4ced1eba5b160c6f36e6bd7177901bc82a9