MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 faf5aedc244976f66ab6711c032a4871ff288c7d394179b11d90aad099c60065. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: faf5aedc244976f66ab6711c032a4871ff288c7d394179b11d90aad099c60065
SHA3-384 hash: f0d75cdea92622234701d3448414e53133efa52c4fd4415e3088bda583104d459c0da22045683d85cb175fd3eb6dcd1f
SHA1 hash: bae52670d18ed29d51895872436f1e0aec4dfba4
MD5 hash: 8780be091b65438e42dfd2b9dbe3c238
humanhash: mockingbird-october-music-sodium
File name:fuck_niggers_10.hta
Download: download sample
File size:496 bytes
First seen:2025-05-17 18:43:49 UTC
Last seen:Never
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 12:kxvsCk9cE3MotZjo/XUTyFJm6AZEcxaWRp0kYI:kbxw8/k2hqbaWsvI
TLSH T17BF00EEB88CACA4DB5909880CF95A3A4658402A11858BC3880E0FC6474322ADED09A38
Magika txt
Reporter abuse_ch
Tags:hta

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Redir-262.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6828d8fb375681df7c1a1f05
Tags:
blic sage hype
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/faf5aedc244976f66ab6711c032a4871ff288c7d394179b11d90aad099c60065/results/dashboard
Payload URLs
URL
File name
https://daftar.site/3GK/fuck_niggers_10.hta?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc0NzUxNDExMiwiaWF0IjoxNzQ3NTA2OTEyLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMTA2OGhvdjA2NTQ4M2xjMW8xZGR2NDMiLCJuYmYiOjE3NDc1MDY5MTIsInRzIjoxNzQ3NTA2OTEyMDQ1MzcwfQ.2DzClgiOoGsVrbbrsLCNT9TcY4CSnMzioEyoPgADrO8&sid=aadabeec-334d-11f0-945e-27a03fbcb5ac');
HTA File
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 fingerprint obfuscated
Link:
https://www.filescan.io/uploads/6828d8f9c609634bd7c71094/reports/fccb00ad-5ae1-4277-a684-70b9ccd12c0f/overview
Verdict:
Malicious
Labled as:
JS/Redirector.QNO trojan
Link:
https://www.hybrid-analysis.com/sample/faf5aedc244976f66ab6711c032a4871ff288c7d394179b11d90aad099c60065
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1693023
Signature
Antivirus detection for URL or domain
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1693023 Sample: fuck_niggers_10.hta Startdate: 17/05/2025 Architecture: WINDOWS Score: 48 19 ww3.daftar.site 2->19 21 obseu.astarsbuilding.com 2->21 23 5 other IPs or domains 2->23 31 Antivirus detection for URL or domain 2->31 8 iexplore.exe 71 74 2->8         started        10 mshta.exe 2->10         started        signatures3 process4 process5 12 iexplore.exe 27 8->12         started        15 iexplore.exe 8 8->15         started        dnsIp6 25 c.parkingcrew.net 185.53.178.30, 49726, 49729, 80 TEAMINTERNET-ASDE Germany 12->25 27 euob.astarsbuilding.com 18.164.154.102, 443, 49725, 49728 MIT-GATEWAYSUS United States 12->27 29 3 other IPs or domains 12->29 17 ssvagent.exe 501 15->17         started        process7
Score:
1%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/faf5aedc244976f66ab6711c032a4871ff288c7d394179b11d90aad099c60065
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/faf5aedc244976f66ab6711c032a4871ff288c7d394179b11d90aad099c60065/
Threat name:
Script-JS.Trojan.Redirector
Create hunting rule
Status:
Malicious
First seen:
2025-05-17 18:44:12 UTC
File Type:
Text (HTML)
Extracted files:
1
AV detection:
3 of 24 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7l225xbejf3pm2vwoeoagksioh7srdd5hfaxtmi5scvnbgogabsq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
defense_evasion discovery trojan
Link:
https://tria.ge/reports/250517-xdhgdsdp3x/
Behaviour
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Checks whether UAC is enabled
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/faf5aedc244976f66ab6711c032a4871ff288c7d394179b11d90aad099c60065

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HTML Application (hta) hta faf5aedc244976f66ab6711c032a4871ff288c7d394179b11d90aad099c60065

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1904439/
  
Delivery method
Distributed via web download

Comments