User tags
Assigned on submission by the user, not by sandbox detections.
source:malwarebazaar
sha256:198cedeb957bc0d11f7e0904c5d183d02e7550859fbf5ab6f7a000dcdd0f53c5
General
- Target 198cedeb957bc0d11f7e0904c5d183d02e7550859fbf5ab6f7a000dcdd0f53c5.zip
- Size 1KB
- Sample260817-fd8j5sem2t
- SHA256 aac16ea2d9f0c2335e120c806524c8152041aa0fbab9ce5fa4d50cf4d30144b8
- MD5 ab95d6eb0721d56aba4b8bc2575278ab
- SHA1 30d860350aa7b299aa12461dddd9774c13a25bd5
- SHA512 9c836659eb4052bc117e002f4080d837e15af1b08fb5e293e5ddff7b750441d4f8c106693708b841c5c7688988cf672820bbde1c962e88956881c0c0692359ba
- TLSH T11E2196CB8AC2550ECE83F6B9593B690378B016846544D7120BEC34E325C5846CF9351B
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
DOC-TNIIQR.lnk
Resource
win10v2004-20260513-en
4 signatures
60 seconds
Behavioral task
behavioral2
Sample
DOC-TNIIQR.lnk
Resource
win11ltsc2024-20260709-en
3 signatures
60 seconds
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB
Targets
-
- Target DOC-TNIIQR.lnk
- Size 2KB
- SHA256 aa2847be88c39d5832c64882122cf2f7b5bdfdc958f4fe7795f1c2995baa9ef8
- MD5 44a2c0a316e8e69aea27b2c77e034c26
- SHA1 8c6e064d0a4e3eb56729dcad29ec1fd555b22078
- SHA512 7c771c30a0cc4f5a8af60d5198df2f166fcc40cec4354c17a384468cae54f40e397dddf2a82a6d663c78f4389754987f9179fec732ce262f73f0dc628bc0f6f2
- TLSH T18A418B902AED12D8F2BB4E36EDFF338048B7B8526D60C65E0840814E0822F01D9B7B77
- MD5 SHA1 SHA512 TLSH
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.