User tags
Assigned on submission by the user, not by sandbox detections.
source:malwarebazaar
sha256:9e3566830358956fe9c3cbf5326c805b2de3f543b7f0cc2cd4fa8ad979e6dba4
General
- Target 9e3566830358956fe9c3cbf5326c805b2de3f543b7f0cc2cd4fa8ad979e6dba4.zip
- Size 1KB
- Sample260827-v9f74aygpc
- SHA256 0b46759de80c1a7383b5cee614a47bd888f27bf31166cbae00ab5c3b34501b61
- MD5 66407495082f41083e58b0a1a36df1c1
- SHA1 2a9acb7569ef2f859875e3c5aed9efda27c22537
- SHA512 0a80e39927e513b3cb72e2e18f4189722b546b9631c5771e73b29baf76ec490a61bc06d84fcca9ca525f8b4c7e94a8228a2481618e3369d3beb576719da18ae4
- TLSH T17E11B946D634DCF2D8352AF090871637259CFE59148B45BF97C8C1983EED141165856C
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
DOC-KXXCZA.lnk
Resource
win10v2004-20260513-en
4 signatures
60 seconds
Behavioral task
behavioral2
Sample
DOC-KXXCZA.lnk
Resource
win11ltsc2024-20260709-en
3 signatures
60 seconds
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB
Targets
-
- Target DOC-KXXCZA.lnk
- Size 2KB
- SHA256 7d75e66df58fd225bae11634b8487d8a8cf6dbb02019d43060636ce7ea951be9
- MD5 d3d3473e528dff78aedf1d45d56e75a0
- SHA1 8810612b91eedc9f7e616605103981e36d7ab71f
- SHA512 658d6ceb1b11a7f40f41f371d6803f7e2baba74fae19a4fc26984d73ae113a327c27c54e69722e8ccc8b48a32829a0b1ae805c43275db433579d2530cacca7b6
- TLSH T1564167442BDD05E8F3FA9E72EDFA7360497BF8616D24D69E0480810C1422B05E676F23
- MD5 SHA1 SHA512 TLSH
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.