Malicious
HTML
MD5: a0b04e318e2e152ffc1bf482facf5c05
Size: 1.39 KB
text/html
Ctrl + scroll to zoom · drag to pan
This sample is a 1.4 KB HTML classified as malicious by Malva.RE. Static analysis extracted 2 embedded or derived files and a malware configuration (URLs in PowerShell). It matches 8 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.001 and T1105. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 2cf2922d0df1857f9fe38b3ab7666f85f791e68ee648e3790630c7ac4136a978
- MD5
- a0b04e318e2e152ffc1bf482facf5c05
- Verdict
- Malicious
- File type
- HTML · 1.4 KB
Cite this report: https://app.malva.re/sha256/2cf2922d0df1857f9fe38b3ab7666f85f791e68ee648e3790630c7ac4136a978
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
HTML file
Size
1.39 KB · 1,388 B
First seen
2026-10-31 21:30 · 2 days ago
Last seen
2026-10-31 21:30 · 2 days ago
Last analysis
2026-10-31 21:30 · 2 days ago
Hashes
MD5
a0b04e318e2e152ffc1bf482facf5c05
Sha1
4244b0cb3769be5f948cbcaf29fbd77dba414512
Sha256
2cf2922d0df1857f9fe38b3ab7666f85f791e68ee648e3790630c7ac4136a978
Sha384
6b653c63f994fc71e824f2053d49a0c8055843b68ffd8036d71cb33e012db884607aeb7a2a6ac759ccf37dea415ba4a0
Sha512
1925760ccb7dd84b77a1342c14631140455ed281a3a810a02d93c7afeff06a19ac80837142cc8acb9f9192d2432c2b0342e21c18cc3d67689cd7a746653027cf
SSDeep
24:NJ2ZSvzdjrsDsKrxoivvFwelYAztdOJVpoYB3OHDkw/IHnVt5PllyiDWTMC6:7pvz4sZivdweqUtsJT4jp/WnVrrC6
TLSH
BF2186601E8E83ACC6EE137C5A48C260C4D7540C6315AB93719CC9423DA1696CFDD79C
3 malicious · 3 files
HTMa0b04e318e2e152ffc1bf482facf5c05T1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
html>scr:ps1~T1059.001~T1105
Shape
html>scr:ps1
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential