Extracted

• • Target
    Factura_N20260909-001655.lnk
  • Size 2KB
  • SHA256 2f868e417f6c2d081e47ed285d2c2a3d64e730915fd1137a31d6eb5c02141bf4
  • MD5 5718b209cb126277cdbb5287d4448614
  • SHA1 b9d2c693b67d46e368f641d8f03b0fa0b39ad769
  • SHA512 adbd83a9b0ec04cf3da7b82a174549b2b9cc20665fe54d3711850567e8746fabfd0e283aa289b236424cc8b4b54db0bc7ac79b872f0ec2ade9b110788c47160b
  • TLSH
    T1C141661023FD4718F2B35F7A68BAEA604A76FD61EA21DA6D0150519C88A1B40ADB0F37
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  behavioral1behavioral2