General
- Target DOC-26824-789056.DOCX.vbs
- Size 1.7MB
- Sample260825-r1195atdrb
- SHA256 0f1351b04bb487803eabba4b6b64baffa4f49b01874b96df1d0e98e24336828c
- MD5 6fa0ee9e3387c9068eea099ee13c252c
- SHA1 4a5aad1532da98d38060aa1c958eddb32fc37b3e
- SHA512 e8631f5ce3d07f4733ba6de46864f90bda34886b7cb89dd549c89060a018361e597e2113278ac26f72e8d2505e6bebec38c0d8e1f0ca94b0f7c4c371b4a42f03
- SSDEEP 24576:HfcH+fYpbGSg0+RwwX6XVeqsI3hmExxGg9lavqVvG:3We
- TLSH T136852B826CD08CF0F9424514D483990FC3FBCE1A96339CAEA954B8D3A99F68F55E50E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
DOC-26824-789056.DOCX.vbs
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
DOC-26824-789056.DOCX.vbs
Resource
win11ltsc2024-20260709-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target DOC-26824-789056.DOCX.vbs
- Size 1.7MB
- SHA256 0f1351b04bb487803eabba4b6b64baffa4f49b01874b96df1d0e98e24336828c
- MD5 6fa0ee9e3387c9068eea099ee13c252c
- SHA1 4a5aad1532da98d38060aa1c958eddb32fc37b3e
- SHA512 e8631f5ce3d07f4733ba6de46864f90bda34886b7cb89dd549c89060a018361e597e2113278ac26f72e8d2505e6bebec38c0d8e1f0ca94b0f7c4c371b4a42f03
- SSDEEP 24576:HfcH+fYpbGSg0+RwwX6XVeqsI3hmExxGg9lavqVvG:3We
- TLSH T136852B826CD08CF0F9424514D483990FC3FBCE1A96339CAEA954B8D3A99F68F55E50E7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Adds Run key to start application
-
Executes a VBScript file via the Windows Script Host.