User tags
Assigned on submission by the user, not by sandbox detections.
source:malwarebazaar
sha256:5691fa898afeb7a28774211e6259991c511277a43aca96a85898eb6cae8a053f
General
- Target 5691fa898afeb7a28774211e6259991c511277a43aca96a85898eb6cae8a053f.zip
- Size 807B
- Sample260817-lrlkeshj4z
- SHA256 04a45ed9083e6855c80e245184084318e5213d1f69d9e80ba54a3537723917b4
- MD5 673778f7537ae1e4424d1f87aec43cc6
- SHA1 f6393ae2368604ab0e812a72af36cf54ef5002ea
- SHA512 4bc477196e0c71ca29294b26a00dde727cd326a529ec66ab8ef3ff280bc868586a1694df12e4d429967a13d70e8f2f29bbded2dd8236b5a5d7d9adfc2fc3efa1
- TLSH T1A8017557264F635BC1B6A4B80BE00B93080396D4B613C306844C25D476B53D51FE6AB4
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
DOC-RXGWZ6.lnk
Resource
win10v2004-20260513-en
4 signatures
60 seconds
Behavioral task
behavioral2
Sample
DOC-RXGWZ6.lnk
Resource
win11ltsc2024-20260709-en
3 signatures
60 seconds
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB
Targets
-
- Target DOC-RXGWZ6.lnk
- Size 1KB
- SHA256 43563998946836662e43b065e356d2e8e3f44965231a609d7dfb50d3305cc730
- MD5 5a13e3c8a932f63ea322c92019de4824
- SHA1 072bdef614e11fc6c61ef009df6f98e1c55d763a
- SHA512 b742e086fb4032e54436949fea4cf90d529244ba517a0214fa27f691d369805d4f8c180e801b4e315f70f8a64aa5adac97c86257612fd686ce8ffde73d99730f
- TLSH T172319C203FEC0514F3F38E7795BB672085BBB9568D20C62D4140454C1022A15E17AF67
- MD5 SHA1 SHA512 TLSH
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.