User tags
Assigned on submission by the user, not by sandbox detections.
source:malwarebazaar
sha256:e6cf4a06b83e49244afdbdb881f257829c39824d712c5ed3c0d97ed40f4cfa61
General
- Target e6cf4a06b83e49244afdbdb881f257829c39824d712c5ed3c0d97ed40f4cfa61.zip
- Size 814B
- Sample260817-y4ezmayfld
- SHA256 cda08e391ed380d50db847d210d547e68714f2320ab50688e8f5a0fa7bdbcf07
- MD5 5daea63257034822de438019e0cfeaa0
- SHA1 fcde6b98bcd12aad0d170f2b82083e64d90519cf
- SHA512 584d219cd441ebb020fe32b6a2d1b71d165d5b655c3de76cb2b95f39c068fed2c218acec32e7278e0ee403bca52a3c07e30297afe6883ec08fbd68d5d36d5b83
- TLSH T171014A9051051F12C8076974495F2054640CA5461F2F58DE4A9D6A6318F5BB7B4D7424
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
DOC-Y8VSR9.lnk
Resource
win10v2004-20260513-en
4 signatures
60 seconds
Behavioral task
behavioral2
Sample
DOC-Y8VSR9.lnk
Resource
win11ltsc2024-20260709-en
3 signatures
60 seconds
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB
Targets
-
- Target DOC-Y8VSR9.lnk
- Size 1KB
- SHA256 944417ddf8cd1603f00eb7bf771a23f1992229c05a987dbbd1497537adce0e91
- MD5 f136a88ab6bca311d5b9a21e2b30ab01
- SHA1 ed104963c76537deb4a12843054c8e911a7a5cf6
- SHA512 e31abe4850dfdfa60f4a95683cfb984f5678fe24022afa200d7ce19af9176038c3fde5662e0268f1fe5f3ae44db37de7f4d73e65a060e943ea3c0e3327553367
- TLSH T12F3197003FFC0624F3B3CEB289BB5B2085BBB8A58D20C62E0041454C1032A19E17BF67
- MD5 SHA1 SHA512 TLSH
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.