MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 967a3a392cfb108d091cf589aff09e1b3b42e31e1f2787c14f8216747972c885. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 967a3a392cfb108d091cf589aff09e1b3b42e31e1f2787c14f8216747972c885
SHA3-384 hash: d7a35eff57575ec975654594ae18321ef2fb3944bb0d4fdeae5689e008e772de544fef2583354c60e844cacac9d85422
SHA1 hash: 3484409401c69fa6f24b600db4dee4632b065e2b
MD5 hash: e77bc60c635ef23338d8b55e26bac3bb
humanhash: orange-princess-wyoming-utah
File name:fuck_niggers_0.hta
Download: download sample
File size:496 bytes
First seen:2025-05-18 05:13:22 UTC
Last seen:Never
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 12:kxvsCk9cE3MobZ/XUKJoH028LD15UWNuYI:kbxs/kNHT8/lI
TLSH T10DF00EEF188BC94CB2A198014FD2A5545DEC114A1058C42D54FA9C64F2313EEAE052BC
Magika txt
Reporter abuse_ch
Tags:hta

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Redir-262.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68296ca5375681df7c1a2fff
Tags:
blic sage hype
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/967a3a392cfb108d091cf589aff09e1b3b42e31e1f2787c14f8216747972c885/results/dashboard
Payload URLs
URL
File name
https://daftar.site/4PCF/fuck_niggers_0.hta?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc0NzU1MjA5MSwiaWF0IjoxNzQ3NTQ0ODkxLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMTA4ZGtlbmhlZjVpdWhrMmswNnZoc2YiLCJuYmYiOjE3NDc1NDQ4OTEsInRzIjoxNzQ3NTQ0ODkxMjQyMjYxfQ.uTPPQN5DvQbZE8Du9N5yUJtFF8h8Clf3Oyh4hBm0s64&sid=18384e29-33a6-11f0-90c6-98ba61d3b140');
HTA File
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 evasive fingerprint obfuscated
Link:
https://www.filescan.io/uploads/68296ca0c609634bd7c752ac/reports/b4685c31-e7e4-4814-867f-aa488f91cac5/overview
Verdict:
Malicious
Labled as:
JS/Redirector.QNO trojan
Link:
https://www.hybrid-analysis.com/sample/967a3a392cfb108d091cf589aff09e1b3b42e31e1f2787c14f8216747972c885
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1693225
Signature
Antivirus detection for URL or domain
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1693225 Sample: fuck_niggers_0.hta Startdate: 18/05/2025 Architecture: WINDOWS Score: 48 19 ww3.daftar.site 2->19 21 obseu.astarsbuilding.com 2->21 23 5 other IPs or domains 2->23 31 Antivirus detection for URL or domain 2->31 8 iexplore.exe 59 73 2->8         started        10 mshta.exe 2->10         started        signatures3 process4 process5 12 iexplore.exe 24 8->12         started        15 iexplore.exe 8 8->15         started        dnsIp6 25 c.parkingcrew.net 185.53.178.30, 49727, 49728, 80 TEAMINTERNET-ASDE Germany 12->25 27 euob.astarsbuilding.com 18.164.154.64, 443, 49725, 49726 MIT-GATEWAYSUS United States 12->27 29 3 other IPs or domains 12->29 17 ssvagent.exe 501 15->17         started        process7
Score:
1%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/967a3a392cfb108d091cf589aff09e1b3b42e31e1f2787c14f8216747972c885
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/967a3a392cfb108d091cf589aff09e1b3b42e31e1f2787c14f8216747972c885/
Threat name:
Script-JS.Trojan.Redirector
Create hunting rule
Status:
Malicious
First seen:
2025-05-18 05:14:09 UTC
File Type:
Text (HTML)
Extracted files:
1
AV detection:
7 of 37 (18.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sz5duojm7mii2ci46we274e6dm5ufyy6d4typqkpqilhi6lszccq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
defense_evasion discovery trojan
Link:
https://tria.ge/reports/250518-fw3fvadr2v/
Behaviour
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Checks whether UAC is enabled
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/967a3a392cfb108d091cf589aff09e1b3b42e31e1f2787c14f8216747972c885

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HTML Application (hta) hta 967a3a392cfb108d091cf589aff09e1b3b42e31e1f2787c14f8216747972c885

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1904459/
  
Delivery method
Distributed via web download

Comments