User tags
Assigned on submission by the user, not by sandbox detections.
source:malwarebazaar
sha256:c16cf54e08d07f1d768bf600e84589adeef3d18589540916606eff994e77fad2
General
- Target c16cf54e08d07f1d768bf600e84589adeef3d18589540916606eff994e77fad2.zip
- Size 810B
- Sample260823-bep2zagh92
- SHA256 e6216cd9c416df02fe0c2502d8df2b24b4396efc4b5018ab9e27cc6b78e371a4
- MD5 35b5a489c531afef6afc930ec778e2e0
- SHA1 a0aab9c0f9a97a97b36db8afff0015fa72c824f0
- SHA512 3e5502b4b0ab182c0adb758f9e25acec8156debeccaedb1d4d83ac38ac70f3b86868f3503a48b1d8bfb81c9a5afc35b9c792f37f7b32fa15f5d590cd159e5e85
- TLSH T1480181BD8968E982E9AD923A3338069A0E9E82F0188F031F1084D4F54C69ED87E93300
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Nota_Fiscal--OJ1WVQ.lnk
Resource
win10v2004-20260513-en
4 signatures
60 seconds
Behavioral task
behavioral2
Sample
Nota_Fiscal--OJ1WVQ.lnk
Resource
win11ltsc2024-20260709-en
3 signatures
60 seconds
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://doc.nfe-online.com/h/estagio1.php?r=391C7CE85D88
Targets
-
- Target Nota_Fiscal--OJ1WVQ.lnk
- Size 1KB
- SHA256 3e4e8e6765d73db570b85d5cadf8e5f19166ccd78a91b67ec0c878f075077c78
- MD5 a97ce19e2e67927ac189959d041b410e
- SHA1 44caf64a065861f4be155e615ff811131ee5c9dc
- SHA512 c1df37cdb12e125255bd1c94db7c56484f4d02f650633294e78d8f28087f32a34fc00ec3cf079b04029bcd6adc94c9d9a5125e7b1fad8f66783a93f35167f40e
- TLSH T1723197103EFD0650F2B38F76847B572089BABC568D218B1D0040464C1022A01E57AF77
- MD5 SHA1 SHA512 TLSH
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.