General
- Target DOC-VTONFM.zip
- Size 590B
- Sample260804-kk6fksgc37
- SHA256 251c8875e608b6669ce59b2cdb057e2bbf911645a3e46ca2f52ca69afcd24dca
- MD5 221b7ad58b5646a31ab90e8944217105
- SHA1 4dae1a25a65d2e70fc61d1602fd479acd40c4d4a
- SHA512 a93e3c639b1239375168cbd54ed334185f7c50e96f5f4c7ac3210419bb9baf06afe4e2262aa477d7b1758bdcb47667373f4a6b18e9739d269e278a778e711115
- TLSH T1B5F096B9C3008005CE00CDF6A28472C207B49F1B40CA9B4321F5C80ACC27AF23A96D96
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
DOC-VTONFM.lnk
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
DOC-VTONFM.lnk
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB
Targets
-
- Target DOC-VTONFM.lnk
- Size 1KB
- SHA256 e1f4a2a2db88d89f6b3e14fa1fe356175f561643e859f6678e8de7a6348461ca
- MD5 be35d64eab2615dce09e7418ed6c0290
- SHA1 4fb40345e9bf0ebb39464b673222c9bffedf4d3f
- SHA512 40192bd9ec94764885bc9b2ba8ce3fcaece1b0ac42e340c6cf3bc603d5594f900661926d36ece77fa0a846eaef65ec5462f70072f7ba48673d1d163ee1923dbc
- TLSH T1423147502FFD0628F3F7CE7794BB572485BAB8A58E20C62D0141454C5033A15E23BFA7
- MD5 SHA1 SHA512 TLSH
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.