User tags
Assigned on submission by the user, not by sandbox detections.
source:malwarebazaar
sha256:bfde96b568208ed7394c6d61b4493168bea7bbb9bf72987ab2f2bfedcec8d293
General
- Target bfde96b568208ed7394c6d61b4493168bea7bbb9bf72987ab2f2bfedcec8d293.zip
- Size 800B
- Sample260821-x3a4lsbm2w
- SHA256 94c66d3e249b30781b99e1f9fd273d85596b01202b6e5a54c1e39afc2eeb9bac
- MD5 85681ae563503200c5a37a6e3da944ec
- SHA1 a532da5efd31de9575db2a6121f808aba65f0888
- SHA512 3dde9264a99185ff9e841942efb560695390f80174255c9ed2409da5eb5ad837279f200e3369f6bebabc6f856f740ab19a5980885f0eaa743b7a61f9ec5cb22d
- TLSH T13601415D8B504E95D157EAFCC90CF568A43060D05F80CC87E81898E7EB25091CFA38C0
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
DOC-41KY4L.lnk
Resource
win10v2004-20260513-en
5 signatures
60 seconds
Behavioral task
behavioral2
Sample
DOC-41KY4L.lnk
Resource
win11ltsc2024-20260709-en
4 signatures
60 seconds
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://ma-pdf.lat/h/estagio1.php?r=391469FB5D82DB
Targets
-
- Target DOC-41KY4L.lnk
- Size 1KB
- SHA256 1a58964e368fd849e9d82d1a9906cec180dae685d64088d15f554be94524d0b7
- MD5 0d46ac65e8f1e272d1e92ead8906402d
- SHA1 eb0ad783c926438c014224a1981e21d10262f57d
- SHA512 d71816c8fda0d4179b8f6f9655bbf4d519534f4a531e63569eee01ca3e5119b3a5776c409ebbbb2a1aa716cfab519ca07fe0bb04dfa08e3959339c8979f7b901
- TLSH T17731CB107EFD0660F3F79E7398BF672489BBB9568D21CA2D4040460C1022A01E23AF67
- MD5 SHA1 SHA512 TLSH
Score10/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.