MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e8dffd14cfd4d2b0b8daa2f9b2cb9a6481c628712d25ae7eb0774c63d77aac2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | e8dffd14cfd4d2b0b8daa2f9b2cb9a6481c628712d25ae7eb0774c63d77aac2e |
|---|---|
| SHA3-384 hash: | 855a0d7fdcd193af48b7eee87489dd61eef84f735d932e5e454d3cb248cf2c8fd8c705e2d1076f9b21e20cf1c733ffc6 |
| SHA1 hash: | c50d5b9bfa6f9c4a2ef6c5e5cff85615ad6682f1 |
| MD5 hash: | d2649ad454355ae8756be8fab82750d4 |
| humanhash: | oregon-sad-single-sink |
| File name: | doc.hta |
| Download: | download sample |
| File size: | 1'696 bytes |
| First seen: | 2026-07-13 13:25:35 UTC |
| Last seen: | Never |
| File type: |  hta |
| MIME type: | text/html |
| ssdeep | 48:6fKggQzA5HzzAYFz05rv0YXZoa4Dk5hI42td:Nj1kyk5Kd |
| TLSH | T1D531244F7C68E01613A1E2A806BBDA5E7D339E4FC04C694F1D9C5C1A8018FF1800D6DB |
| Magika | html |
| Reporter |  skocherhan |
| Tags: | hta larpers-su |
Intelligence
File Origin
# of uploads :
1
# of downloads :
87
Origin country :
GBVendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
90.2%
Tags:
dropper virus
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Payload URLs
URL
File name
https://larpers.su/api/d/005938c9f1c34a94bbaba2669f416ece/a?t=c02c427fb98281902f67b523a83a2760
HTA File
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
obfuscated
Verdict:
Malicious
File Type:
hta
First seen:
2026-07-09T19:22:00Z UTC
Last seen:
2026-07-09T19:46:00Z UTC
Hits:
~1000
Score:
44%
Verdict:
Susipicious
File Type:
SCRIPT
Gathering data
Threat name:
Win32.Dropper.Generic
Status:
Suspicious
First seen:
2026-07-10 00:58:12 UTC
File Type:
Text (VBS)
AV detection:
7 of 36 (19.44%)
Threat level:
3/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
adware discovery spyware
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Checks computer location settings
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
01c2658a8f028d1f0d4c9fdada9ad7d7
hta e8dffd14cfd4d2b0b8daa2f9b2cb9a6481c628712d25ae7eb0774c63d77aac2e
(this sample)
Dropped by
MD5 01c2658a8f028d1f0d4c9fdada9ad7d7
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.