User tags
Assigned on submission by the user, not by sandbox detections.
source:malwarebazaar
sha256:141ee69062d033c181ce08b14030cb546c4335cc52034d3784c117fded58c2b3
General
- Target 141ee69062d033c181ce08b14030cb546c4335cc52034d3784c117fded58c2b3.zip
- Size 815B
- Sample260818-pp4vrssdlg
- SHA256 78b70080830871ff39403f231aa501fa211aadff27a2e8a2db85536eb5c5a7f6
- MD5 95b83cca2fd7b91a7b9bc3e897b3b253
- SHA1 e316b1f7d27082ca95561629d8ddc8ec12c6fd05
- SHA512 7ea44d0ad754edc4e934744253e6bc195731ff3d4f579155e54c139ea970f866b06b854cd804f9ecd2e2ca96eabcb476c17a70f6d77e58b435a02b0ff4fa06db
- TLSH T1FC01F10EA881B995C88E0B33C9D36F316924EAA727AC015E55CA15F65D065921AD6D10
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Xml_Fiscal_-R4ER6D.lnk
Resource
win10v2004-20260513-en
4 signatures
60 seconds
Behavioral task
behavioral2
Sample
Xml_Fiscal_-R4ER6D.lnk
Resource
win11ltsc2024-20260709-en
3 signatures
60 seconds
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://doc.nfiscais.com/h/estagio1.php?r=391C7CE85D88
Targets
-
- Target Xml_Fiscal_-R4ER6D.lnk
- Size 1KB
- SHA256 a4bb4aa3a7103748ccdd5815b2184bcae59095a74fba148ac8bd7d374ffb0296
- MD5 9693d081e8ef116c26eb89be8b9a3494
- SHA1 9b40945dce3897081f7bb1d36e301a03c0644a20
- SHA512 2e78962e246b1257066965898faa2c997c2a5da46e4e2edbd7d367d7162d2872e41b31606728b3c8910022c96d7ceb316a55e1f2e49fbf20e734e81ed8a303f7
- TLSH T1243147102EF90694F2F38E7784BB671089BAB8658E20C61E4040464C5472E05EA7BFA7
- MD5 SHA1 SHA512 TLSH
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.