9246e2253190050751b8ff8f503b9cf565c9ebc42512188d76cc4d90b7ab0e02 | Triage™

Login
Reports

Overview

overview

7

Static

static

5

KYQEV35610...5G.vbs

windows10-2004-x64

7

KYQEV35610...5G.vbs

windows11-21h2-x64

7

~/hfdfz1.dll

windows10-2004-x64

3

~/hfdfz1.dll

windows11-21h2-x64

3

~/iamhc/vh...c3.pdf

windows10-2004-x64

3

~/iamhc/vh...c3.pdf

windows11-21h2-x64

3

~/iamhc/vh...y7.pdf

windows10-2004-x64

3

~/iamhc/vh...y7.pdf

windows11-21h2-x64

3

~/iamhc/vh...r8.pdf

windows10-2004-x64

3

~/iamhc/vh...r8.pdf

windows11-21h2-x64

3

~/iamhc/vh...o1.pdf

windows10-2004-x64

3

~/iamhc/vh...o1.pdf

windows11-21h2-x64

3

~/iamhc/vh...s2.pdf

windows10-2004-x64

3

~/iamhc/vh...s2.pdf

windows11-21h2-x64

3

~/iamhc/vh...d5.pdf

windows10-2004-x64

3

~/iamhc/vh...d5.pdf

windows11-21h2-x64

3

~/iamhc/vh...10.pdf

windows10-2004-x64

3

~/iamhc/vh...10.pdf

windows11-21h2-x64

3

~/iamhc/vh...j6.pdf

windows10-2004-x64

3

~/iamhc/vh...j6.pdf

windows11-21h2-x64

3

~/iamhc/vh...o9.pdf

windows10-2004-x64

3

~/iamhc/vh...o9.pdf

windows11-21h2-x64

3

~/iamhc/vh...r4.pdf

windows10-2004-x64

3

~/iamhc/vh...r4.pdf

windows11-21h2-x64

3

~/rqhbff2.dll

windows10-2004-x64

3

~/rqhbff2.dll

windows11-21h2-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
CnvnLNAZ04155-4QO3YXQBE.iso
Size 5.0MB
Sample260421-ya35csbs9p
SHA256 9246e2253190050751b8ff8f503b9cf565c9ebc42512188d76cc4d90b7ab0e02
MD5 a9c9bb85518dd4546c4a38b9bca326a0
SHA1 dd9c3f2f036dc2abdf9fc96a214ab9e66a480f9a
SHA512 a2c1a40464ffa3d3ef3a01d3d9c986108ef0c270beb3aed8ad4a83d3478c853fab90936ec25d4b71991e79280fe370a80b468aed3c8fa1890737439667404f74
SSDEEP 49152:L0Ab/wl/XgI+f+pEq0A4dRCa7j5hQZ9ab6l2tTJBns4zd4k4XozXznTLs:Vs
TLSH
T161362332AA85482FC6950379B06F2E176F3EA65347C961D378DC62423B87FC5963E0C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery link pdf qr spyware

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

KYQEV356106Convncn_G79YSVzyjm93236-TATBN54S5G.vbs

Resource

win10v2004-20260130-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

KYQEV356106Convncn_G79YSVzyjm93236-TATBN54S5G.vbs

Resource

win11-20260130-en

windows11-21h2-x64

4 signatures

150 seconds

Behavioral task

behavioral3

Sample

~/hfdfz1.dll

Resource

win10v2004-20260130-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

~/hfdfz1.dll

Resource

win11-20260130-en

windows11-21h2-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

~/iamhc/vhdkpd/aydi/nxlg/bekgjc3.pdf

Resource

win10v2004-20260130-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral6

Sample

~/iamhc/vhdkpd/aydi/nxlg/bekgjc3.pdf

Resource

win11-20260130-en

windows11-21h2-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral7

Sample

~/iamhc/vhdkpd/aydi/nxlg/ebkry7.pdf

Resource

win10v2004-20260130-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral8

Sample

~/iamhc/vhdkpd/aydi/nxlg/ebkry7.pdf

Resource

win11-20260130-en

windows11-21h2-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral9

Sample

~/iamhc/vhdkpd/aydi/nxlg/kjbr8.pdf

Resource

win10v2004-20260130-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral10

Sample

~/iamhc/vhdkpd/aydi/nxlg/kjbr8.pdf

Resource

win11-20260130-en

windows11-21h2-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral11

Sample

~/iamhc/vhdkpd/aydi/nxlg/kzeayo1.pdf

Resource

win10v2004-20260130-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral12

Sample

~/iamhc/vhdkpd/aydi/nxlg/kzeayo1.pdf

Resource

win11-20260130-en

windows11-21h2-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral13

Sample

~/iamhc/vhdkpd/aydi/nxlg/lexs2.pdf

Resource

win10v2004-20260130-en

windows10-2004-x64

6 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral14

Sample

~/iamhc/vhdkpd/aydi/nxlg/lexs2.pdf

Resource

win11-20260130-en

windows11-21h2-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral15

Sample

~/iamhc/vhdkpd/aydi/nxlg/mkgd5.pdf

Resource

win10v2004-20260130-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral16

Sample

~/iamhc/vhdkpd/aydi/nxlg/mkgd5.pdf

Resource

win11-20260130-en

windows11-21h2-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral17

Sample

~/iamhc/vhdkpd/aydi/nxlg/nceja10.pdf

Resource

win10v2004-20260130-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral18

Sample

~/iamhc/vhdkpd/aydi/nxlg/nceja10.pdf

Resource

win11-20260130-en

windows11-21h2-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral19

Sample

~/iamhc/vhdkpd/aydi/nxlg/tkqj6.pdf

Resource

win10v2004-20260130-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral20

Sample

~/iamhc/vhdkpd/aydi/nxlg/tkqj6.pdf

Resource

win11-20260130-en

windows11-21h2-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral21

Sample

~/iamhc/vhdkpd/aydi/nxlg/vcxo9.pdf

Resource

win10v2004-20260130-en

windows10-2004-x64

6 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral22

Sample

~/iamhc/vhdkpd/aydi/nxlg/vcxo9.pdf

Resource

win11-20260130-en

windows11-21h2-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral23

Sample

~/iamhc/vhdkpd/aydi/nxlg/zmsr4.pdf

Resource

win10v2004-20260130-en

windows10-2004-x64

6 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral24

Sample

~/iamhc/vhdkpd/aydi/nxlg/zmsr4.pdf

Resource

win11-20260130-en

windows11-21h2-x64

6 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral25

Sample

~/rqhbff2.dll

Resource

win10v2004-20260130-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral26

Sample

~/rqhbff2.dll

Resource

win11-20260130-en

windows11-21h2-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  KYQEV356106Convncn_G79YSVzyjm93236-TATBN54S5G.vbs
- Size 4.2MB
- SHA256 eb56d87f475f8066d88a2029a5af2744641b197c5d0ba722151bf3fcc831535e
- MD5 dfe1c39afaafdd66283bb9cd40ad63a7
- SHA1 ad5beb45c8439b111ca3c72c5817646b726a3b0c
- SHA512 406b25407790ac4216bf37ddf34f63e519b7bcbe4dba40d26829d4841cccf590bc1025f4f1e92312875986e3b3c7dda48f55318c216779112d7db27ac2de6453
- SSDEEP 49152:r0Ab/wl/XgI+f+pEq0A4dRCa7j5hQZ9ab6l2tTJBns4zd4k4XozXr:5
- TLSH
  T16A263332AE951C2F0798073AB02F3E277F7E8953858EB2D185D8635235CBBC5426F459
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2
- Target
  ~/hfdfz1.xml
- Size 67KB
- SHA256 861e8afcc8b73a58aae71ac4c0ed6961683d9a0d76b69d10860dab9681a4999e
- MD5 0ad3d53d8e3bb8815d311b83604e6547
- SHA1 9beec3ba8ea309d1ca162513987d3226dbecd840
- SHA512 d977525e1a7ca67a206559fb4c42ebd4b4b0c7610e3cba4da473981f8477eb0b38815fbdbf0d697d47a53ea2421101b55b4b16e84fa6eaa2dcf88158fa49d23e
- SSDEEP 1536:gMS7YjYeb2+fwius1trZ5tJIgdHh364XZOBdzoKb73P:gMS7YjYebVdBJvK4XZOBfb7f
- TLSH
  T158632857FB4AC0B9E94581780CB6A78A5277F6E11FB045D3B288230F8E677E92D310D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  ~/iamhc/vhdkpd/aydi/nxlg/bekgjc3.pdf
- Size 24KB
- SHA256 42e25c37232b2b2b93df9a923f757d40656235735d161b22853019d9864479b8
- MD5 0f51b5fde707c9d664eb07c0b6de6e01
- SHA1 8f76ca07cd0707345ccd4b6691d57839752644e5
- SHA512 0b26bf0606523cf4f884bbbe5dc6753f5756bb1475809049b12f6cedde883296cd4981e13545f950b290f83cbe9ab2b2ee31e37a83ed5663a4712c3410e7021e
- SSDEEP 384:b6vN4dKzkQDCpLjmlx8eUBgUntKKc82JFThmp9rd5XD06lgmUHKzba9xLRv:b6vNhDCpPm38e6jcTJF4p946lPE
- TLSH
  T14AB2B0835E454D66E4F18750BF03EF0E6B5A7E84704B77D710B69CCA7B24AC29C0A62D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  ~/iamhc/vhdkpd/aydi/nxlg/ebkry7.pdf
- Size 37KB
- SHA256 45d7952b63f7064681858c536a337a7e608b7b9f7da03d1047cab63fdea5263b
- MD5 9dfd753f2a32c7e195e4e1c77b5d0c7f
- SHA1 de5bfe9ff88f2ce470a49a06e33d1713b0704f15
- SHA512 16830a532c6d21814d2bc48b2c8766e4943fa154ad0e5e67d2e65d2b8164d6123ac8c761a4c5e2e51ad228a67460c9e1e93b4022dbbd031f9d95bdc77dd06163
- SSDEEP 768:jFo0irYoFD/2i3BjdqCP2XTrKDwoJM17K8uh9VN2Ince4pmYQ/:iHNd3Bj5P2juwGCK8ajcHM/
- TLSH
  T162039C179E05C98CD49A95867EAF7C6D5B1D333A7EC02AE63C6D0EC29B00C91EC5B487
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  ~/iamhc/vhdkpd/aydi/nxlg/kjbr8.pdf
- Size 24KB
- SHA256 69993682a4f1ed4b826fb893caaea25fb955865fbf2902e4567f456cd3231ef5
- MD5 44ab75d89d61a31a4ab45e606c613205
- SHA1 fbcf5ccdf7352871b1f879b6e9f0454a5baf1bb6
- SHA512 8e195203e1819dd57e75f5175577fdbde67058ac1d06b902724b1499f6b315bbc28198fd84ed08258e20d363848442093bf66913e93349a831fe0c22fc729a7c
- SSDEEP 384:sBfGD0KtrrWvBbdj0fb8rOtW/X2WBiXRzw2iEmhAXzSp3ustqgKYIAlE0/CQ9x8n:wfkXqBQb8HX29XIAXz9iqKIA+hp
- TLSH
  T13DB28D192183C8A59F535AC7BF1DBC92905CB30F66A49D631C2C8E925883FF5FA1E4C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  ~/iamhc/vhdkpd/aydi/nxlg/kzeayo1.pdf
- Size 1KB
- SHA256 b7744303249a322c3bdf94c5b16057d156c2a1cadd0ada563c39c325d35603b2
- MD5 c3e51622b819d2ae3e850212bfa8c33d
- SHA1 f90ff712ddcda07e9cb1b3cbaa9358f2451304b4
- SHA512 8e613536738e2907a5386e2e61f6d791e9cb01edde2170c25a1db0bc49f29ab9ac2995ea0a257c2411ec67402c13f6c395b5a8fb8606a358aea1a0637034bc39
- TLSH
  T1AE418418A9D89CDCF4B385517F1E38C7A43DB10326E8A8C1126DC20F488AFD9BE63607
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  ~/iamhc/vhdkpd/aydi/nxlg/lexs2.pdf
- Size 38KB
- SHA256 fb83dc5c94b5356bbf08a5c3dc9efa6d8812b270132151368d4889f4d926e6da
- MD5 617d685270333d15dc6396c6fbc137af
- SHA1 83284779920af6efdfc446c93cd311c2e61c38f0
- SHA512 5e0fb70babc5bd019665e61bb09dc33a56bea963703ed8d94568b89b2cbb1f7ab28a51954dac4ec263ac89f4023e3c55cfbed488147eb7e9c36f5cc57ea363f9
- SSDEEP 768:L6IlCJijP4KMByHhpNEOcpzI0iZGIqwFxMO1DdUD3mxDYvz4VdmfiIvftKu//31v:L6IygwK9BpNOzrGMmxDMz4V2vfvPFuQl
- TLSH
  T13403E1B06231B809EAD7675DBFA13D49458E3A42CDD128C3D8618AFF7574AD39862EC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  ~/iamhc/vhdkpd/aydi/nxlg/mkgd5.pdf
- Size 25KB
- SHA256 d8a939595c8105ece6189b480d96a6884e9790fc93980c385d666da57f372d88
- MD5 eea518aed26f9f80d92dd6849b3bc8eb
- SHA1 ed41fd87b9b173d7729878e280479807cef5417b
- SHA512 c93b98f08aaf2bac86f9b57ace0bea267bfaa0d23874773e0b7087838ff179e246f331aa5847828142ce26e5e22e192cc72a464df6caf30ed50e8d9aaa129e17
- SSDEEP 768:M57rOIaJhtyGeMmH6PqrDcUFsw3q7f0vtO3iqKIA+h3:M5nO5JSG8Rr4UD3qne+Z
- TLSH
  T1BAC29E4A2547C550EB0742DAFB2FBDA7A149B30F2268C8811D6D9DA21A57FE4F20D1C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  ~/iamhc/vhdkpd/aydi/nxlg/nceja10.pdf
- Size 24KB
- SHA256 dcd115f95c3bd1ae2ee4479c9dcaf96391f900845d21844e546bc2e3b1c469f5
- MD5 172e9ca72d015f8da1fe7ec3acb0b3e5
- SHA1 7a7df7c38364e6f006256b9432def2d04325cfa1
- SHA512 9782ccdf04706c30a10cc8acf9f72435f5a1a2040dd794e3296f814bb0cc8dee5bdab11b274877602978ee234068e437e75b23c4ebac30fe3a52e95eed8a3c61
- SSDEEP 384:Lcr1BdEQDCpLjmlx8eUBgUntKKc82JFThmp9rd5XD06lgmUHKzba9xLRf:Lcr17DCpPm38e6jcTJF4p946lPk
- TLSH
  T1DDB2B0834C494D67E4F18790BF13EF0E5B6A7E84714B7BE720A398C57B249C25C1925E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  ~/iamhc/vhdkpd/aydi/nxlg/tkqj6.pdf
- Size 33KB
- SHA256 56d870a75385026c575569f0f0d89d757d73e827c1b9f890b4da7d5c53516bae
- MD5 70ebf93e7bbe30714bcf9ecb40760610
- SHA1 759f9713986c8b9f9ee2debd83da6adefb8627cd
- SHA512 e35368ff20401cf1fa05057dd1344e202bb27a1faffaabb726a570b2893aaa3a9689f782a3c604c0dda45c0f4b5d4df3ff6dc17064f5223f6db8c935246d23e2
- SSDEEP 384:QnY3q6OvFOx03wj/hSlBaDEXqGJWl127wwc35JJEccWLcy5hRxoN8yT2zk+M+5:QiNswVuUWD7wN35wbKtSKP4+v5
- TLSH
  T19DE2BFB3F1F518CCEC8647468A593DE9085EF127C5C83CC220798786A585F6DB7225DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  ~/iamhc/vhdkpd/aydi/nxlg/vcxo9.pdf
- Size 25KB
- SHA256 91258cc25e35feb951a9b3e6f99f4b082c6220a2fff982e0a45bc5c17f4932b5
- MD5 ae228fcc1253d7b6f62b0d25f4a8cd8c
- SHA1 aaa00684ac41010de9dafe390fa9a2378b09a585
- SHA512 74d67bb287b588b3d8131aabee17c111a3fe9595c3052d36df30580959e433f3ed38d7ef860afe272d33c1a984844184da79740777f0f626dc83621ef9b37747
- SSDEEP 384:mEbw9P6AMtdx9+3zxG+DiG4DLcgz6U7soWmXyOVa5jDPTYJ3ustqgKYIAlE0/CQ5:KP6A8dx9+tJqDggzWof3o1EQiqKIA+h+
- TLSH
  T1FFB27C882503D4A5FF5752D6FF5D69A16088E30F50605CE22DBD8D97890BEF9F60E1C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  ~/iamhc/vhdkpd/aydi/nxlg/zmsr4.pdf
- Size 1KB
- SHA256 2dc91464eb06b7e3af2b5f128c508ce82e7d72d8fca65d51b7436d1172cf7c1c
- MD5 a2d07d312b789418751b4326edbf2016
- SHA1 fe7d38447c6e79ef07f57abbbfb13922e339ddef
- SHA512 b48a8356976137ad4facc766c41642e1a47183ee996492ba4fe74499d71463a14c2f43ecde576d1314e3dacfcdcdded16b752f88df0a6de47584db753abe97c1
- TLSH
  T1823196789E2B8CB480B3DEB8B8E1E7C4196151EF2349418431D0BD936EC3D87872669A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  ~/rqhbff2.xml
- Size 63KB
- SHA256 3992dbccf18e03c0183f61cc8bddd4bcef7c3617fbb3e399b355d20bbf4589ce
- MD5 9fc0a78ea1bed4abb0fe25093d906acf
- SHA1 b21737389318f70a5174eb2fec352b37483e34a9
- SHA512 28b54caf7eaf847518a2b5ae7aac20d5b1578a24facc5bebdc05eb0c77909667e779d69b3e44a2083487d2642a7dece9636861a5e8d6c5165a9bbfe456bfa899
- SSDEEP 1536:KmKy1UIKgEqRPwHHnToIfiIOjIOy3VEKV:NKYwHHTBfAFy3qs
- TLSH
  T1C8538C06EA809273C5F40A79D5EACA6D8E3A32500BAD91E32DDD6BD02D047F573752CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

adwarediscoveryspyware

behavioral6

adwarediscoveryspyware

behavioral7

adwarediscoveryspyware

behavioral8

adwarediscoveryspyware

behavioral9

adwarediscoveryspyware

behavioral10

adwarediscoveryspyware

behavioral11

adwarediscoveryspyware

behavioral12

adwarediscoveryspyware

behavioral13

adwarediscoveryspyware

behavioral14

adwarediscoveryspyware

behavioral15

adwarediscoveryspyware

behavioral16

adwarediscoveryspyware

behavioral17

adwarediscoveryspyware

behavioral18

adwarediscoveryspyware

behavioral19

adwarediscoveryspyware

behavioral20

adwarediscoveryspyware

behavioral21

adwarediscoveryspyware

behavioral22

adwarediscoveryspyware

behavioral23

adwarediscoveryspyware

behavioral24

adwarediscoveryspyware

behavioral25

behavioral26

© 2018-2026

Terms | Privacy