2cbf402dcc45ce94cc2394a726ae29c26cb65814839732f00379bc2f904cb125

Analysis

max time kernel
298s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nomina 08.7.2026.pdf.jse
Size 81KB
Sample260808-hhn3easbrf
SHA256 2cbf402dcc45ce94cc2394a726ae29c26cb65814839732f00379bc2f904cb125
MD5 3d4a769ab617f4ed472460ee28d23908
SHA1 ebc4a62c395e987587ea6ed2c655eb978607648a
SHA512 f6d2fb4f0c1434aa6eda1c5c6a6f6c88213f34bb80ce0d96e6bea82bf1f1f88bbd625d108a050d480b0ce19f5e9f88ec5d6448b37bc61a69aa0d80dcf4491ce7
SSDEEP 768:mRgHE0IszEKYrFOvAow99ZREQ3kaZLjBlKRgKN+dmb2aPRXAElTrFbNjOBK+xm+u:m+zONJLXjdTNZF0wjskURVxAe
TLSH
T1A4830C155AC6748053366BBFA22B9CD5F37A072B02901817B87C6450EFF2D0AEED9C79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	6076	WScript.exe
4	6076	WScript.exe
6	6076	WScript.exe
8	6076	WScript.exe
11	6076	WScript.exe
12	6076	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Local\Temp\Nomina 08.7.2026.pdf.jse"
1⤵
- Badlisted process makes network request
PID:6076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6076-5-0x0000018476260000-0x000001847667E000-memory.dmp

Download

memory/6076-8-0x0000018476260000-0x000001847667E000-memory.dmp