MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c1b4405a7937ea23ecb2030021cd76d89ecbbe8a8445833d6082386d6fda493. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c1b4405a7937ea23ecb2030021cd76d89ecbbe8a8445833d6082386d6fda493
SHA3-384 hash: a483d2868abb7fdb34f03544cde20669ef561f3536c5d1082efe14cfeb55e440c99489a974ce521a194afbef786f8e58
SHA1 hash: f6bd0f8f5f6ed883602c7b8830a91ba0004605ea
MD5 hash: c51108b9528f890e095ffba96341a113
humanhash: missouri-failed-pluto-island
File name:Invoice.pdf.url
Download: download sample
File size:284 bytes
First seen:2025-11-17 10:27:16 UTC
Last seen:2025-11-17 12:07:36 UTC
File type:
MIME type:application/x-mswinurl
ssdeep 6:HRYFVmyCTcnJ5mDsKLDBBArSDxDXtKznGE54vVG/4xHy:HRYFVm0DW3BBArSlXtHfVW4xS
TLSH T18FD012348241C14DD6513A39ACE0BD15640DBDA78CC3BB8C1496D86A05904AAB55439A
TrID 84.6% (.URL) Windows URL shortcut (11000/1/2)
7.6% (.INI) Generic INI configuration (1000/1)
7.6% (.JSON) JSON array (generic) (1000/1)
Magika internetshortcut
Reporter cocaman
Tags:INVOICE url

Intelligence

File Origin
# of uploads :
19
# of downloads :
45
Origin country :
CH CH
Vendor Threat Intelligence
Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=691af88ebdb0ec3a9dc2af70
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/691af889f239f08d354a40dc/reports/486a14d2-c7c8-4bca-9b0d-6968313d1436/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/3c1b4405a7937ea23ecb2030021cd76d89ecbbe8a8445833d6082386d6fda493
Verdict:
Malicious
File Type:
text.internetshortcut
First seen:
2025-11-14T18:28:00Z UTC
Last seen:
2025-11-16T00:43:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.WinINF.Alien.gen
Link:
https://opentip.kaspersky.com/3c1b4405a7937ea23ecb2030021cd76d89ecbbe8a8445833d6082386d6fda493/results?tab=lookup
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/3c1b4405a7937ea23ecb2030021cd76d89ecbbe8a8445833d6082386d6fda493
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3c1b4405a7937ea23ecb2030021cd76d89ecbbe8a8445833d6082386d6fda493/
Verdict:
Malicious
Threat:
Trojan.WinINF.Alien
Link:
https://tip.neiki.dev/file/3c1b4405a7937ea23ecb2030021cd76d89ecbbe8a8445833d6082386d6fda493
Threat name:
Shortcut.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-11-15 16:54:20 UTC
File Type:
Text
AV detection:
5 of 24 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hqnuibnhsn7kepwleayaehgxnwe6zo7ivbcfqm6wbarynvx5usjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3c1b4405a7937ea23ecb2030021cd76d89ecbbe8a8445833d6082386d6fda493

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Methodology_Shortcut_HotKey
Create hunting rule
Author:@itsreallynick (Nick Carr)
Description:Detects possible shortcut usage for .URL persistence
Reference:https://twitter.com/cglyer/status/1176184798248919044

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip b2921e1ff0b86b3f5435b81ba6327a26e84169af136a594bac21625095daf8d1

3c1b4405a7937ea23ecb2030021cd76d89ecbbe8a8445833d6082386d6fda493

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 b2921e1ff0b86b3f5435b81ba6327a26e84169af136a594bac21625095daf8d1
  
Dropped by
MD5 df260e14a2cb6278b39c2a0eef64671b

Comments