General
- Target DOC-W79OCQ.zip
- Size 588B
- Sample260803-qs5rxazelc
- SHA256 533c4d33810d46c4a62569f883eda226f6b1c0a064aee795c342f7847f9d73fd
- MD5 25d97680a733d44c616e14962827e16b
- SHA1 30617ca8aa51a4e88b6c4736221a5c3b4b895d91
- SHA512 5c3ef5b483dabcd08407debe3141102ef3d71b6287299e56857e9b8abc925617d742bd77a3e02ff41b9a8f7b253c29ee60e8ce05f0f82cd5eaff21b7327dbefd
- TLSH T10AF0962E77A95080E204D032DF216D49439C41E072086E4103A4EC30A80834BAF46922
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
DOC-W79OCQ.lnk
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
DOC-W79OCQ.lnk
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://bro-pdffiller.lat/h/estagio1.php?r=360761F15794
Targets
-
- Target DOC-W79OCQ.lnk
- Size 1KB
- SHA256 47183df50e384d8421ebba549e94d41f8e43f8c8edb87b0600a78fb1d236b942
- MD5 651ad36ddfb7fb89ab56a74e91d36462
- SHA1 263c0aa1eb8a2ab69ff99365ffc2e0b21db435bf
- SHA512 2eee57d24c9cba5a1f92186567eee6b4299a108c3f768e0e444fabf6c58b48ead012cfae72abb3470cefde4a3e402fa26e4a4bbdf19243d50e4617d091088a2c
- TLSH T16A3197503FF90A14F3F38E3394BB571089BBBC968E20CA1D0041460C5032A05E1BAFA7
- MD5 SHA1 SHA512 TLSH
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.