User tags
Assigned on submission by the user, not by sandbox detections.
source:malwarebazaar
sha256:664cbb5ba971a4ac5180c47d53e3f20e6cec33f69db96b1490977edc37c25b41
General
- Target 664cbb5ba971a4ac5180c47d53e3f20e6cec33f69db96b1490977edc37c25b41.zip
- Size 1KB
- Sample260822-eb24xa1arb
- SHA256 c063e8ddeda3f0f527fdb5ad81e83fde09f523bfdb68ca39c0772b1a78db402f
- MD5 c410ff9646626ed71ca9761ce24150b8
- SHA1 10e349d375cc44ae014938e85e970ead94153044
- SHA512 657d6de111a3d0969fa28e9f1f354c13d3190ac4a7f40b2e03ee0396167a7c7f278b4b3b8226b005da5bc7d313d181eaf4b3d34ff433267d1143f462b1654acc
- TLSH T19B1175974BAA37CFF962913040F4444898D54E7CECD4B6BB1929780A6618EF482C5223
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
DOC-8CVTK8.lnk
Resource
win10v2004-20260513-en
4 signatures
60 seconds
Behavioral task
behavioral2
Sample
DOC-8CVTK8.lnk
Resource
win11ltsc2024-20260709-en
3 signatures
60 seconds
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB
Targets
-
- Target DOC-8CVTK8.lnk
- Size 2KB
- SHA256 d2e47f8affac05570ac55368402e94b70f5e2bb38df04388278f7661ba40a35a
- MD5 adb3c7912055debcbb758f472684c600
- SHA1 1df7d86304bd7013a363ba955a4a2902b0b5dcaf
- SHA512 b8ef7777b62200b9e1f848056866a925a795aebd1b971bbf9dd4dc2a0e25c9a343a7aceaae0eabedacd93e1e1d21e412e1a4512c658b066d636a5965475bff00
- TLSH T17C4167446AE90198F3FB8E72ECBE670009BB78615DB0C69D0841820D5422B02E577B63
- MD5 SHA1 SHA512 TLSH
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.