MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 490585f82a0ddaafd9eead803859e06dafc0219a5bd1c08482c98f3d37eec231. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 490585f82a0ddaafd9eead803859e06dafc0219a5bd1c08482c98f3d37eec231
SHA3-384 hash: 45dd19c9daa849e6749a330cf9178dcc1f3292b5c9e6440ed09f626da98f580a07118b6644b2ca55bf16fedc20beec74
SHA1 hash: c65f5d8b9072aefafeee73227610f4082843762a
MD5 hash: 9cc761eefd1cd30408a4328aec6ea511
humanhash: india-winner-bravo-stairway
File name:Заявка на закупку от компании ООО Боровково на июнь 2026г.zip
Download: download sample
File size:148'715 bytes
First seen:2026-05-26 10:35:23 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:p4zaA7QVLvcYS+SbJ121Tz/+JR+M3IAOvwi8fG+KOsWyk5aJEkD7fFzmxE:yp7QVL0Ik7YTzORRskG+KOJykQJ9L4q
TLSH T174E312099CCC04D7CA7FA449C8826DEA2D7D92CB159FFF22B77A303954ADF500B191A8
Magika zip
Reporter smica83
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
HU HU
File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:Заявка на закупку от компании ООО Боровково на июнь 2026г.lnk
File size:1'381 bytes
SHA256 hash: bea07bc2359e8f3ce914b0027b5548ae58c9a019f330446b2c81050cd9ca1b0d
MD5 hash: c9386d789015d30f85546d04c1331f60
MIME type:application/octet-stream
File name:Реквизиты ООО Боровково (НОВЫЕ).doc
File size:34'304 bytes
SHA256 hash: 45154678b808a70316f0172a5012ffdfc7d7ddcde856440099fcdbad64e84ddb
MD5 hash: 3c74d2ff9b610be84183587d7a4ff6ef
MIME type:application/msword
File name:Выписка из ЕГРЮЛ.pdf
File size:149'605 bytes
SHA256 hash: 9fa461bd75788d27ceb778dc0f9773d641e804b3e10103c482ba4747153178f8
MD5 hash: fc00460dda7b44a1fea71cf24f4cfa6d
MIME type:application/pdf
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/08b7d0e8-1ea8-47ca-b80f-642cbe1e2736/
Detection(s):
Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.KingForADaypshell.20231121.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Zip.LNK-3.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a1577765b1db29f5a47fce0
Tags:
obfuscate xtreme virus
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
language-ru
Link:
https://www.filescan.io/uploads/6a157773099ef368af00559f/reports/da025b06-e97b-4399-8b0f-fc93a2fc93c6/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/490585f82a0ddaafd9eead803859e06dafc0219a5bd1c08482c98f3d37eec231
Verdict:
Malicious
File Type:
zip
First seen:
2026-05-25T03:14:00Z UTC
Last seen:
2026-05-25T11:53:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/490585f82a0ddaafd9eead803859e06dafc0219a5bd1c08482c98f3d37eec231/results?tab=lookup
Score:
3%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/490585f82a0ddaafd9eead803859e06dafc0219a5bd1c08482c98f3d37eec231
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/490585f82a0ddaafd9eead803859e06dafc0219a5bd1c08482c98f3d37eec231/
Threat name:
Shortcut.Trojan.FakeNotepad
Create hunting rule
Status:
Malicious
First seen:
2026-05-25 10:12:49 UTC
File Type:
Binary (Archive)
Extracted files:
50
AV detection:
10 of 23 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jecyl6bkbxnk7wpovwadqwpanwx4aim2lpi4bbeczght2n7oyiyq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
adware discovery spyware
Link:
https://tria.ge/reports/260526-nh4ezsay9s/
Behaviour
Checks processor information in registry
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/490585f82a0ddaafd9eead803859e06dafc0219a5bd1c08482c98f3d37eec231

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:LNK_sospechosos
Create hunting rule
Author:Germán Fernández
Description:Detecta archivos .lnk sospechosos
Rule name:SUSP_LNK_PowerShell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference to powershell inside an lnk file, which is suspicious

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments