User tags
Assigned on submission by the user, not by sandbox detections.
source:malwarebazaar
sha256:2b909089a1f667b83f3603a75ead178037835b01480196299e6ff8a478e23b04
General
- Target 2b909089a1f667b83f3603a75ead178037835b01480196299e6ff8a478e23b04.zip
- Size 806B
- Sample260827-amsbmaybke
- SHA256 070f6d2d21c142220d857abacf72192953c838476a1ebdf0853d257bb43f1ad7
- MD5 fc3c41cb5895a1706fbd39f82f115224
- SHA1 24de0bbe25b1c12f562105ff13f3a4253980b514
- SHA512 c4d8c3f7580ec7adcd7d2bff27a7e7e75dc7721585f149b31de2f8bfbb752b1c7a0993bb543104d2bbf8f25c31697076c22bc6238b2e2b9414be63b0130c080e
- TLSH T1FE018136B61E5C86D403933446C63677171BB23EA26C4005868C9C26296AFDA19C3590
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
DOC-VP5DZY.lnk
Resource
win10v2004-20260513-en
4 signatures
60 seconds
Behavioral task
behavioral2
Sample
DOC-VP5DZY.lnk
Resource
win11ltsc2024-20260710-en
3 signatures
60 seconds
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB
Targets
-
- Target DOC-VP5DZY.lnk
- Size 1KB
- SHA256 49085b57f5eeb2913505a80969d5a5e82fe8012982f1391924df197ae6dca622
- MD5 7693e20c901bb6752939735a3681cfed
- SHA1 cf25d56723e77017ec290389661fc35a394dee14
- SHA512 e7638b8e6b971475cb032fbf0f10858e85e987d6490fd39963daffc5d74aa0f562074f93ac1324aef9fe2fc73099f0bd6242ab9e7b01f85037d3d403eb667ca5
- TLSH T1E5317B503FED0628F3F38F7795BB572495BBB8968D20CB2D0181454C5432A15E17AFA7
- MD5 SHA1 SHA512 TLSH
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.