SUSPICIOUS — 06f74f2d63642dd6e1e2c141ada023b736a506ff03b43893ddba18c412b3c2d9.hta
SUSPICIOUS — 06f74f2d63642dd6e1e2c141ada023b736a506ff03b43893ddba18c412b3c2d9.hta is a hta sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (57/100). 2 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
06f74f2d63642dd6e1e2c141ada023b736a506ff03b43893ddba18c412b3c2d9 - SHA-1:
21d9e9939d67afa85fed87ba266719d09ae0346b - MD5:
9f6b673cb2fcb7112b3afb08c081288b - ssdeep:
48:862cf3ZRwIQHvT4/SY9zHeFpc9O/tOLScDOAshPa1VW4DNM:fRwIQHcN9zHeFpc9OVOL1DOAsh8VW4RM - TLSH:
T17C16AC5DEB60388BDC4765463AF73DEDA481C5A26496F0B97E893113C1ABC2C094C21A - Submitted as: 06f74f2d63642dd6e1e2c141ada023b736a506ff03b43893ddba18c412b3c2d9.hta
- File type: hta · Size: 2717 bytes
- Verdict: suspicious (57/100)
Source: MalwareBazaar · first seen 2026-08-03T00:00:00.000Z · SHA-256 verified
Detections (2 of 53 engines)
- Emsisoft (Emergency Kit): Trojan.GenericKD.81018329
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 57/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec (layers: char-code) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Document contains macros/active content: hta-application, activex - static signal, weight 0.35, confidence 0.75
Dynamic analysis (windows)
7092 behavior events · 2 ATT&CK techniques · 7 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- atualizaonavegador.com
- c.pki.goog
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
Dropped files
- C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 -
63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0 - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 -
3cc8acf2394b8059a5c311d167b038e8dfa7acdb94ff75a4dbcec97e70709d5b - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D05BE67AF840ABC07952CC06B9011C79 -
4ba6b099b1b3fa60d9341c79b46e9f4a33b406b68b362d8d056324cc527fd41a - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 -
d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 -
fd6167fe0b4478bf1cc246cf34c2683f89e24272211674e347e291eba5080544 - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D05BE67AF840ABC07952CC06B9011C79 -
f3ad17d491b801cdc4e6187130109dcc60ad5858d44f00cc84279ba786d7b034 - 115c26ce28cace692a3b9188ab688bf48d6724223bca12661b190b7905ca498a -
115c26ce28cace692a3b9188ab688bf48d6724223bca12661b190b7905ca498a
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787643868&P2=404&P3=2&P4=ZvUvE3PqP8KgqVBiUef5W4UM%2fIg3iezPnvRw%2fnSKUwEsvWm45UXlTt9%2bVk2ZcXpGXUBtq9JLTWRUATq1WOuRag%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://c.pki.goog/r/gsr1.crl
- http://c.pki.goog/r/r4.crl
- http://c.pki.goog/we1/QnuDYkUfA5s.crl
- http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787643940&P2=404&P3=2&P4=Z8b0HF6Xn%2f%2bpjoxV%2bKzpGoYcDPkPEKl3U38hzXJwD2w1sjIr%2fNNrQoZqpuT6e5dGaqIN1EXFpcDzkS39Q30A0Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- atualizaonavegador.com
Embedded IP addresses
- 4.247.188.233
- 4.150.223.106
- 52.123.252.219
- 4.230.171.124
- 172.215.188.225
- 52.230.59.222
- 52.123.252.197
- 135.233.95.80
- 135.233.95.144
- 74.179.77.164
- 51.105.71.136
- 203.26.79.13
- 20.231.239.246
- 52.123.129.14
- 135.233.45.222
- 104.21.10.187
- 142.250.195.131
- 74.178.232.29
- 52.148.114.188
- 72.145.35.100
- 4.150.223.111
- 52.110.12.50
- 52.110.12.3
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report