MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e716ca99e984fe3bb273cd413c094f8b39fea23d566839e1e80030aa03e42e67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 2

Intelligence 2 IOCs YARA 1 File information Comments

SHA256 hash:	e716ca99e984fe3bb273cd413c094f8b39fea23d566839e1e80030aa03e42e67
SHA3-384 hash:	5ef2045795326e0a5cae779608d86a2dbd22d3243db4261f4aa0db75b8613dbd8d2f2ca8418495fc5437e644bde17797
SHA1 hash:	ed515a2c7db2835992af1f9e788b611d5297649d
MD5 hash:	338cff038bf230511fc3c5dccc27bdf3
humanhash:	artist-romeo-sad-tennis
File name:	riiw1.mp3
Download:	download sample
File size:	1'182'728 bytes
First seen:	2025-01-16 15:29:03 UTC
Last seen:	Never
File type:	hta
MIME type:	application/octet-stream
ssdeep	24576:aJbo/pBHKcbHDbYETcvh9lWAgs2IDGMSpSbwByRJ9XdqL45A:aRo/u4j8AcvUBshXSp3ByRJtAs5A
TLSH	T1F945332E29858304FF276605F8A55F6FC72AD7E757021106BA08DFD9C18EACBC6B2D44
Magika	unknown
Reporter	aachum
Tags:	FakeMp3 hta

iamaachum

https://f1.foiloverturnarrival.shop/riiw1.mp3

Intelligence

File Origin

# of uploads :

# of downloads :

118

Origin country :

Vendor Threat Intelligence

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67895776aa9c8e7858df1058

Tags:

n/a

Result

Verdict:

Clean

File Type:

HTA File

Link:

https://app.docguard.net/e716ca99e984fe3bb273cd413c094f8b39fea23d566839e1e80030aa03e42e67/results/dashboard

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/67892624d9291dce6675b649/reports/07bd1e7f-46bc-45e9-97ae-2eba0b2ce81e/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e716ca99e984fe3bb273cd413c094f8b39fea23d566839e1e80030aa03e42e67

Result

Verdict:

UNKNOWN

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

2 / 100

Link:

https://www.joesandbox.com/analysis/1593070

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e716ca99e984fe3bb273cd413c094f8b39fea23d566839e1e80030aa03e42e67/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=44lmvgpjqt7dxmttzvatyckprm475ir5kzudtypiaaykua7efztq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250116-xn7h9strat/

Behaviour

Modifies Internet Explorer settings

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.15

Link:

https://yomi.yoroi.company/submissions/e716ca99e984fe3bb273cd413c094f8b39fea23d566839e1e80030aa03e42e67

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)