MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95d30188fcc3864a6c8f9c01e27a588ea2b456f55b737c27f4b0cd756b887013. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	95d30188fcc3864a6c8f9c01e27a588ea2b456f55b737c27f4b0cd756b887013
SHA3-384 hash:	6dfaf00f1b419d84c1bce19e34d266c7ee8b0938a26f53f6b6642f26c8be9f1b78e306febf2a0b9b3024c14340f10e6c
SHA1 hash:	4a906aa7e8193d36ded8a1e43dd8014c253b7275
MD5 hash:	421913ed92e54f42fc90f543084b8803
humanhash:	eighteen-december-single-london
File name:	Протокол про адміністративне правопорушення за ч.2 ст.210-1 КУпАП серії РТЦК 04-16782_13.08.2025.HTA
Download:	download sample
Signature	Gamaredon Alert Create hunting rule
File size:	57'473 bytes
First seen:	2025-08-13 15:08:25 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	1536:+HxFsjcFQezFor9T4sx68eItfZISp/mMUkIKaxbMAtvIVO5WwscW5ABgFY+bXAK3:XR48p/mMUjrxbMWvIVO5WCW5ABgFY+l3
TLSH	T129437CAEEA57188107EE1ED7C04B0D822D9A8052FD3670F73127535658A1C90AFDF6BD
Magika	html
Reporter	smica83
Tags:	gamaredon hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

33

Origin country :

HU

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689caaa72018ee52f0246f89

Tags:

dropper virus spawn

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/95d30188fcc3864a6c8f9c01e27a588ea2b456f55b737c27f4b0cd756b887013/results/dashboard

Behaviour

BlacklistAPI detected

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1756150

Signature

Multi AV Scanner detection for submitted file

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

56%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/95d30188fcc3864a6c8f9c01e27a588ea2b456f55b737c27f4b0cd756b887013

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Html

Link:

https://app.malva.re/file/421913ed92e54f42fc90f543084b8803

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/95d30188fcc3864a6c8f9c01e27a588ea2b456f55b737c27f4b0cd756b887013/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Gamaredon

Threat name:

Script-WScript.Trojan.Gamaredon

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-08-13 15:33:21 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sxjqdch4yodeu3eptqa6e6syr2rlivxvlnzxyj7uwdgxk24ioajq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery

Link:

https://tria.ge/reports/250813-sjmwvaswf1/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Checks computer location settings

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/95d30188fcc3864a6c8f9c01e27a588ea2b456f55b737c27f4b0cd756b887013