MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2988ff46fa33c35646ce8447f8d24ebefa42cbca16c9de9f766a81142e57f53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e2988ff46fa33c35646ce8447f8d24ebefa42cbca16c9de9f766a81142e57f53
SHA3-384 hash:	8c61b7711df690c4f7b3adbce310b32860dec06cab2d24e73f52c5e4a7359624eb9894c6645099d11679c844e9ad80e8
SHA1 hash:	e3f614ebadd08f94ef9e4ad7a073843a8323cb4e
MD5 hash:	ec9f6ffef480b8a2723e92511a0a6c5d
humanhash:	shade-network-illinois-oklahoma
File name:	HWW.hta
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	1'010'063 bytes
First seen:	2026-08-12 12:16:40 UTC
Last seen:	Never
File type:	hta
MIME type:	text/plain
ssdeep	384:7TKYNSYkY7YRTHY6THYkYPYNoTKYNoTx5YkYhYRYLYaYLYrYkYkY7Y95Y7YRTHYs:Kvc1
TLSH	T14325A1F9228E2480D9500C30CD2E61D6AB57D24C4F692E743939F6EF2B86DED6F61C64
Magika	javascript
Reporter	James_inthe_box
Tags:	exe hta xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

49

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/e2988ff46fa33c35646ce8447f8d24ebefa42cbca16c9de9f766a81142e57f53/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

obfuscated repaired

Link:

https://www.filescan.io/uploads/6a7caeb109295bef15a14722/reports/2df76f20-f891-47f0-903b-194debf1023e/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e2988ff46fa33c35646ce8447f8d24ebefa42cbca16c9de9f766a81142e57f53

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-08-12T11:16:00Z UTC

Last seen:

2026-08-14T01:49:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/e2988ff46fa33c35646ce8447f8d24ebefa42cbca16c9de9f766a81142e57f53/results?tab=lookup

Nucleon Malprob Susipicious

Score:

37%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/e2988ff46fa33c35646ce8447f8d24ebefa42cbca16c9de9f766a81142e57f53

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/ec9f6ffef480b8a2723e92511a0a6c5d

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Script-JS.Trojan.Malgent

Threat name:

Script-JS.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-12 17:31:11 UTC

File Type:

Binary

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4kmi75dpum6dkzdm5bch7dje5px2ilf4ufwj32pxm2ubcqxfp5jq._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm collection discovery execution rat trojan

Link:

https://tria.ge/reports/260812-v5nflsea68/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Executes dropped EXE

Badlisted process makes network request

Detect Xworm Payload

Family: Xworm

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e2988ff46fa33c35646ce8447f8d24ebefa42cbca16c9de9f766a81142e57f53