General
- Target DOC-IQWMID.zip
- Size 886B
- Sample260804-kh3a5swamf
- SHA256 e2d6c921384df4f85598c52843abecbfe7500cca1211894f2c919a0bf2b3834e
- MD5 eee9fb16e03327f397516a63947fc3c7
- SHA1 41a6f70f022f6c45ca2db3d183640acfecf6e28a
- SHA512 4d47143f5c05d1cd4d573959ba558cb01004c661a2fed058cc4e49435e6d6683ca0a0cf0e529e113f05b29a3c8097aa359d65f06eda453dc3f134a5a27f0232c
- TLSH T18F1196776772AA18DB825871D80336EAD26F3266002BD40AB3A563DC5D92340DB70C16
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
DOC-IQWMID.lnk
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
DOC-IQWMID.lnk
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB
Targets
-
- Target DOC-IQWMID.lnk
- Size 2KB
- SHA256 74e1b8f273f6e2bf1c72cca199f999728e5a06474f9cdc623aca741fe0082108
- MD5 2b6ddc071dcf5b9d906e88e127bf4c3a
- SHA1 e055158940bf00f9493932a072b37ecdd5bc105a
- SHA512 39bbc71526b7b4dac70df7e088d0c6419737b7b54fda922be37c9d583f132280f60ba9bae80ce5f037a9a3b1bac21114a4d410acf65be7705a41cb17faf33e46
- TLSH T14F4149902AED00D8F3FB9D33EDBB1754887BB8566E71C54E0590820E0822B01D677B67
- MD5 SHA1 SHA512 TLSH
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.