MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af860c5ce9401a7fed857169da9522966b5a5269b2a8a030aaf902299947eb5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	af860c5ce9401a7fed857169da9522966b5a5269b2a8a030aaf902299947eb5b
SHA3-384 hash:	fa8bd14d5dc0f981c658daf7e818cdd0d6287cf58432a08deb152a69f6587dbdf04abd43180ee43862e6f4df64ef55cc
SHA1 hash:	3dbbdf68953fa4defd6686f6fa4e4f08665b855f
MD5 hash:	02b1394a8ee31ed7770e275b060b0837
humanhash:	quebec-minnesota-magnesium-black
File name:	2-1180-25_24.06.2025.HTA
Download:	download sample
File size:	4'183 bytes
First seen:	2025-06-24 15:20:58 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	96:bfAsYb68ABejMBDdyue7xEtjF/o/5/b/I/m/0/D/qLAsQCFWP8MWIglHk63d:xYb686mMyv7xEt+7HFWP4nHk6t
TLSH	T1BE81CC8D3C8D66204293B19EC8B199C41C2F2905BA3647D22F31B74B21D7BD4E52AF3B
Magika	vba
Reporter	abuse_ch
Tags:	hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

53

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.HTA.Gamaredon-D.24161.17032.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685a53e5b06783b9ebd6cfb8

Tags:

phishing spawn overt sage

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/af860c5ce9401a7fed857169da9522966b5a5269b2a8a030aaf902299947eb5b/results/dashboard

Payload URLs

URL

File name

https://lydiapvJ.com

HTA File

Behaviour

BlacklistAPI detected

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/af860c5ce9401a7fed857169da9522966b5a5269b2a8a030aaf902299947eb5b

Joe Sandbox suspicious

Result

Threat name:

n/a

Detection:

suspicious

Classification:

troj

Score:

22 / 100

Link:

https://www.joesandbox.com/analysis/1722004

Signature

Uses dynamic DNS services

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

20%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/af860c5ce9401a7fed857169da9522966b5a5269b2a8a030aaf902299947eb5b

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Html

Link:

https://app.malva.re/file/02b1394a8ee31ed7770e275b060b0837

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/af860c5ce9401a7fed857169da9522966b5a5269b2a8a030aaf902299947eb5b/

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/af860c5ce9401a7fed857169da9522966b5a5269b2a8a030aaf902299947eb5b

ReversingLabs TitaniumCloud Script-WScript.Trojan.Gamaredon

Threat name:

Script-WScript.Trojan.Gamaredon

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-24 07:30:06 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v6dayxhjianh73mfofu5vfjcszvvuutjwkukamfk7ebctgkh5nnq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery

Link:

https://tria.ge/reports/250624-symjmaek2w/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Checks computer location settings

Blocklisted process makes network request

Malware Config

Dropper Extraction:

http://google.com@document-downloads.ddns.net/OD/quitzU2/comparativelyNWU.jpeg

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.