MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff6fd5e3494dc16064da750116bb9d899c52560af353be6a430d42daeb6435b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ff6fd5e3494dc16064da750116bb9d899c52560af353be6a430d42daeb6435b0
SHA3-384 hash:	fc81c3e9f1c033e5c2ffc6b704b7339771041d2e4da9d23684b4002f0f2e88d88a60390d703072eecc204099475c205f
SHA1 hash:	efc60c8a669c9a4c510ee0a60db6372a7e448ded
MD5 hash:	eb69e57a301155cb14d28da233d8fd43
humanhash:	alaska-kitten-undress-tennis
File name:	yamfloor.hta
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	1'079'963 bytes
First seen:	2026-08-12 07:45:52 UTC
Last seen:	Never
File type:	hta
MIME type:	text/plain
ssdeep	768:7rU7Gh66DBZFpZr5b6b6BFVphUV/DbGrE5lLPP/rZPvr5fpb6BrZZZ5rPrlLlxE7:DVg
TLSH	T1933570E3568E6CA5D930ADE2BD066083F135E1C818D0FDEE37B9158F9C9A59CCB24721
Magika	javascript
Reporter	abuse_ch
Tags:	AgentTesla hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

78

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.DownLoader.10717.5950.6728.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/ff6fd5e3494dc16064da750116bb9d899c52560af353be6a430d42daeb6435b0/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

obfuscated repaired

Link:

https://www.filescan.io/uploads/6a7c254e62e620dae1d9dc47/reports/e06ea334-ecd8-4783-b4bd-80c7a0f524ce/overview

Hybrid Analysis VBS/TrojanDownloader.Agent

Verdict:

Malicious

Labled as:

VBS/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/ff6fd5e3494dc16064da750116bb9d899c52560af353be6a430d42daeb6435b0

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-08-11T12:14:00Z UTC

Last seen:

2026-08-13T06:20:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/ff6fd5e3494dc16064da750116bb9d899c52560af353be6a430d42daeb6435b0/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1956708

Signature

Antivirus detection for URL or domain

Creates processes via WMI

Detected large data written to user environment variables, potentially indicating payload staging for fileless execution

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious MSHTA Child Process

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

10%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/ff6fd5e3494dc16064da750116bb9d899c52560af353be6a430d42daeb6435b0

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/eb69e57a301155cb14d28da233d8fd43

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/ff6fd5e3494dc16064da750116bb9d899c52560af353be6a430d42daeb6435b0/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=75x5ly2jjxawazg2ouarno45rgofevqk6nj342sdbvbnv23egwya._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260812-jnb6gacn7y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Badlisted process makes network request

Process spawned unexpected child process

VMRay AgentTesla

Malware family:

AgentTesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ff6fd5e3494d/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ff6fd5e3494dc16064da750116bb9d899c52560af353be6a430d42daeb6435b0