MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a13e4f5e885ff9dbfa3719fbb1821df0f0c97f020d93d50ebd34cba94bb4ee0a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a13e4f5e885ff9dbfa3719fbb1821df0f0c97f020d93d50ebd34cba94bb4ee0a
SHA3-384 hash:	7180fc848724976a6ca5b8bc77d4355edc5c28ebd71c2e15dadbe6cd5e0aaf8a2181dcb30595b8cb4c25162bac37c491
SHA1 hash:	5dd2dd4c35a26575f5920243603a570777fb65cb
MD5 hash:	83de529a0f4b39c85e5f76cce945946d
humanhash:	lithium-washington-alabama-virginia
File name:	gg4.hta
Download:	download sample
File size:	176 bytes
First seen:	2025-08-08 00:08:35 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	3:qVZx/XMnkAqRAdu6/GY7voOn3QkdK4cdfONvMmRYHURVPR8TtNJNp79kBbZWM:qzx/XnAqJm79gFlfOVMm+HURlSTluB9d
TLSH	T149C080DB4CB1C14254D09481DED1E654D81555442545CCE399C9C57574047DB6D453DB
Magika	html
Reporter	abuse_ch
Tags:	hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

32

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6895403811d7f9b979e6726b

Tags:

spawn blic sage

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

HTA File

Link:

https://app.docguard.net/a13e4f5e885ff9dbfa3719fbb1821df0f0c97f020d93d50ebd34cba94bb4ee0a/results/dashboard

Payload URLs

URL

File name

https://block.cloud.lionic.com/blockpage/malicious.html?t=3&url=http://8.134.74.227/gg4.hta

HTA File

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/a13e4f5e885ff9dbfa3719fbb1821df0f0c97f020d93d50ebd34cba94bb4ee0a

Joe Sandbox clean

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

1 / 100

Link:

https://www.joesandbox.com/analysis/1752710

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/a13e4f5e885ff9dbfa3719fbb1821df0f0c97f020d93d50ebd34cba94bb4ee0a

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/83de529a0f4b39c85e5f76cce945946d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a13e4f5e885ff9dbfa3719fbb1821df0f0c97f020d93d50ebd34cba94bb4ee0a/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ue7e6xuil745x6rxdh53daq56dyms7ycbwj5kdv5gtf2ss5u5yfa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

adware defense_evasion discovery persistence ransomware spyware stealer trojan

Link:

https://tria.ge/reports/250808-afpl6askw7/

Behaviour

Modifies Internet Explorer settings

Modifies Internet Explorer start page

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

System Location Discovery: System Language Discovery

Checks whether UAC is enabled

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a13e4f5e885ff9dbfa3719fbb1821df0f0c97f020d93d50ebd34cba94bb4ee0a