MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0e440a9658784f649a601bed6a688a44f8c365bc42b0242064dddd704f213cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b0e440a9658784f649a601bed6a688a44f8c365bc42b0242064dddd704f213cb
SHA3-384 hash:	66f3e25a650b2d678e60a5a597e98e02eba2aaaadca198c6ff956c1431de916125f57fdc2a1d9ac9ff2b765c8b814ffd
SHA1 hash:	ffee08d4929bacc57dd017decd168fd2972b2638
MD5 hash:	0d4bfe583692885b9ab59e8f10f15d76
humanhash:	crazy-aspen-alabama-kansas
File name:	wedecidedtoreleasegoodthingsforme.hta
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	28'497 bytes
First seen:	2025-05-19 17:28:21 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	96:/55O6yW0baB5DdyW0bL0YXoVBgd1/l5Li5HcjyW0b3E5e:/5g6yW3BjyWBYXoVBgdLENcjyWsEY
TLSH	T162D247E6C7AABC96CD53BB2EF5392724409D192DDCB5C994F651B00A84E4349E0F0ECE
Magika	txt
Reporter	abuse_ch
Tags:	FormBook hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

83

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.28212.6193.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=682c328f2f280a98fb422b30

Tags:

obfuscate shell sage

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/682b6a4deb4a449b32487f05/reports/0ebbe42b-ef3f-407b-a2ca-06dcde2699e2/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b0e440a9658784f649a601bed6a688a44f8c365bc42b0242064dddd704f213cb

Joe Sandbox Cobalt Strike

Result

Threat name:

Cobalt Strike

Alert

Create hunting rule

Detection:

malicious

Classification:

expl.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1694590

Signature

Detected Cobalt Strike Beacon

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Multi AV Scanner detection for submitted file

PowerShell case anomaly found

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Suspicious MSHTA Child Process

Suspicious command line found

Suspicious powershell command line found

Uses threadpools to delay analysis

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b0e440a9658784f649a601bed6a688a44f8c365bc42b0242064dddd704f213cb

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b0e440a9658784f649a601bed6a688a44f8c365bc42b0242064dddd704f213cb/

ReversingLabs TitaniumCloud Script-WScript.Downloader.Nemucod

Threat name:

Script-WScript.Downloader.Nemucod

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-12 16:04:14 UTC

File Type:

Text (JavaScript)

AV detection:

11 of 37 (29.73%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wdsebklfq6cpmsngag7nnjuiurhyyns3yqvqeqqgjxo5obhscpfq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b0e440a9658784f649a601bed6a688a44f8c365bc42b0242064dddd704f213cb