MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e07b33b5560bbef2e4ae055a062fdf5b6a7e5b097283a77a0ec87edb7a354725. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 5 File information Comments

SHA256 hash:	e07b33b5560bbef2e4ae055a062fdf5b6a7e5b097283a77a0ec87edb7a354725
SHA3-384 hash:	f9f7640717bafd3920d09f11758ccd5fb381a146ee3e73c35232bd8e15a64cbff5da4e92e5f5aeeca278db964e24b130
SHA1 hash:	ab6fd65c57cf09862582c945962d3fc03ce496e1
MD5 hash:	cd00b3c263fe03b00ea349635a746570
humanhash:	aspen-red-jig-foxtrot
File name:	Договір _2025.rar
Download:	download sample
File size:	766 bytes
First seen:	2025-06-20 09:44:50 UTC
Last seen:	2025-07-08 09:44:15 UTC
File type:	zip
MIME type:	application/zip
ssdeep	12:5qKBZjyZqQsK2l2nY5CRWrP0YLadY93cxKPioYzf7ZkVB9c/GmGDqGu1++kX9tay:lOZAdwnY5CRWXadwwDaVLuG9X+kz
TLSH	T1B90175CA568110C7D5896A35789964009764449A8BB01732EED797614D8FDD00C9340F
Magika	zip
Reporter	Anonymous
Tags:	zip

Intelligence

File Origin

# of uploads :

# of downloads :

104

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Договір _2025.lnk
File size:	703 bytes
SHA256 hash:	78ca4a3aa6a2d53756647b8be5e3c3549a673763f9ef1a62cb43e2eb77a49e43
MD5 hash:	35750cc292cf2f56fceb22dade3d8870
MIME type:	application/octet-stream

Vendor Threat Intelligence

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68552dc4511de2c8101b16e9

Tags:

spawn

Result

Verdict:

Unknown

File Type:

ZIP File

Link:

https://app.docguard.net/e07b33b5560bbef2e4ae055a062fdf5b6a7e5b097283a77a0ec87edb7a354725/results/dashboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

lolbin mshta obfuscated

Link:

https://www.filescan.io/uploads/68552dcb3faf8fcd7d381ab2/reports/fed8143c-fda5-4194-b16b-e0f80339d748/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e07b33b5560bbef2e4ae055a062fdf5b6a7e5b097283a77a0ec87edb7a354725

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/e07b33b5560bbef2e4ae055a062fdf5b6a7e5b097283a77a0ec87edb7a354725

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Zip Archive

Link:

https://app.malva.re/file/cd00b3c263fe03b00ea349635a746570

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e07b33b5560bbef2e4ae055a062fdf5b6a7e5b097283a77a0ec87edb7a354725/

Verdict:

Malicious

Threat:

Shortcut.Trojan.DangerousPasswordLazarus

Link:

https://tip.neiki.dev/file/e07b33b5560bbef2e4ae055a062fdf5b6a7e5b097283a77a0ec87edb7a354725

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2025-06-19 16:08:59 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

7 of 24 (29.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4b5thnkwbo7pfzfoavnaml67lnvh4wyjokb2o6qozb7nw6rvi4sq._file

Result

Malware family:

n/a

Score:

10/10

Tags:

discovery persistence spyware stealer

Link:

https://tria.ge/reports/250620-ltlcfawnz7/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Adds Run key to start application

Network Service Discovery

Network Share Discovery

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Blocklisted process makes network request

Malware Config

Dropper Extraction:

https://secfileshare.com/5.hta

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e07b33b5560bbef2e4ae055a062fdf5b6a7e5b097283a77a0ec87edb7a354725

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Download_in_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies download artefacts in shortcut (LNK) files.

Rule name:	Script_in_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies scripting artefacts in shortcut (LNK) files.

Rule name:	SUSP_ZIP_LNK_PhishAttachment Create hunting rule
Author:	ignacior
Description:	Detects suspicius tiny ZIP files with malicious lnk files
Reference:	Internal Research

Rule name:	SUSP_ZIP_LNK_PhishAttachment_Pattern_Jun22_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects suspicious tiny ZIP files with phishing attachment characteristics
Reference:	Internal Research

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)