MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d60256be8cc16fbdd17d1155fcd9534aa00be927442982af338925f56019608b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d60256be8cc16fbdd17d1155fcd9534aa00be927442982af338925f56019608b
SHA3-384 hash: d4c5069f93a3cd12ade5eadfd024bbb46da50875c3eb58db33fbed2c573be7d881fed2be1e7284c4c1d60145a9d727c9
SHA1 hash: 0bc1cf66018c9220ea873370485a9166ddaf2f9e
MD5 hash: b1726015590bea521fc78d8ab8cae4ec
humanhash: oklahoma-steak-charlie-wisconsin
File name:fuck_niggers_19.hta
Download: download sample
File size:497 bytes
First seen:2025-05-19 01:18:24 UTC
Last seen:Never
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 12:kxvsCk9cE3Moa0W/XU+MzUqJmruGUo+nS2gkE7RneYI:kbxT9/k8svgndI
TLSH T133F09EFB0CCBCC8D6AB215C18BE8669A04C8846A1579D42544E45C71B93029EDD0A130
Magika txt
Reporter abuse_ch
Tags:hta

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Redir-262.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=682a8855375681df7c1a87dd
Tags:
blic sage hype
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/d60256be8cc16fbdd17d1155fcd9534aa00be927442982af338925f56019608b/results/dashboard
Payload URLs
URL
File name
https://daftar.site/6T22/fuck_niggers_19.hta?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc0NzYyNDI1MiwiaWF0IjoxNzQ3NjE3MDUyLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMTBjZ3NwdXBkM3AwOGFocGcxYm00ODEiLCJuYmYiOjE3NDc2MTcwNTIsInRzIjoxNzQ3NjE3MDUyNzIwMDM0fQ.X4BfzYsrvF2GC4WureYZMAF3ZaoWbKpJ18FqJt4b7Ug&sid=1bcff568-344e-11f0-af1c-f13729800f9e');
HTA File
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 obfuscated
Link:
https://www.filescan.io/uploads/682a8714c609634bd7c7fb85/reports/9689c001-eff5-454a-ad02-76935aa71f8d/overview
Verdict:
Malicious
Labled as:
JS/Redirector.QNO trojan
Link:
https://www.hybrid-analysis.com/sample/d60256be8cc16fbdd17d1155fcd9534aa00be927442982af338925f56019608b
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1693660
Signature
Antivirus detection for URL or domain
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1693660 Sample: fuck_niggers_19.hta Startdate: 19/05/2025 Architecture: WINDOWS Score: 48 18 daftar.site 2->18 20 Antivirus detection for URL or domain 2->20 8 iexplore.exe 68 74 2->8         started        10 mshta.exe 2->10         started        signatures3 process4 process5 12 iexplore.exe 8 8->12         started        14 iexplore.exe 18 8->14         started        process6 16 ssvagent.exe 501 12->16         started       
Score:
2%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/d60256be8cc16fbdd17d1155fcd9534aa00be927442982af338925f56019608b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d60256be8cc16fbdd17d1155fcd9534aa00be927442982af338925f56019608b/
Threat name:
Document-HTML.Trojan.Redirector
Create hunting rule
Status:
Malicious
First seen:
2025-05-19 01:19:18 UTC
File Type:
Text (HTML)
Extracted files:
1
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ybfnpumyfx33ul5cfk7zwktjkqax2jhiquyflztres7kyazmcfq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
defense_evasion discovery trojan
Link:
https://tria.ge/reports/250519-bpm1csgk31/
Behaviour
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Checks whether UAC is enabled
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d60256be8cc16fbdd17d1155fcd9534aa00be927442982af338925f56019608b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HTML Application (hta) hta d60256be8cc16fbdd17d1155fcd9534aa00be927442982af338925f56019608b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1904384/
  
Delivery method
Distributed via web download

Comments