MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d5dae158e928f5c8c49d92a462d932a7e39f7c76510ab11b666e4e2d5783ca0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments

SHA256 hash:	9d5dae158e928f5c8c49d92a462d932a7e39f7c76510ab11b666e4e2d5783ca0
SHA3-384 hash:	7e17465d510be2f602d8f13d75d9c60154fc89cb167432bf8a021b117f3fc03ec2b50a5948522cdd1d07fa82fbb5f0a9
SHA1 hash:	32d427420a47f3ad032f088f26f3c3d6bc33efca
MD5 hash:	0dd946c9d4f5727c765526420d194425
humanhash:	purple-two-red-uniform
File name:	МОНГОЛ УЛСЫН НЭГДСЭН ТӨСВИЙН 2027 ОНЫ ТӨСВИЙН ХҮРЭЭНИЙ МЭДЭГДЭЛ, 2028-2029 ОНЫ ТӨСВИЙН ТӨСӨӨЛЛИЙН ТУХАЙ.lnk
Download:	download sample
File size:	1'431 bytes
First seen:	2026-09-25 08:24:27 UTC
Last seen:	Never
File type:	lnk
MIME type:	application/x-ms-shortcut
ssdeep	24:8A/BwKcMb+/eMgXIJUoLeDhiW8qzJ0zfMxsv7lgW8AW/hIu:8E+dMtXcFaEW8qazfxeW8AW
TLSH	T1AC212C1476FA5714F2F39EB944BAF11189767867DDA6DB4D0008818E2935A00FD33F22
Magika	lnk
Reporter	smica83
Tags:	lnk

Intelligence

File Origin

# of uploads :

# of downloads :

114

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

LNK

Details

Link:

https://research.acce.ciphertechsolutions.com/results/02f2b3e6-da3c-4e76-a7c8-e871de8e8abd/

Detection(s):

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL

Result

Verdict:

Malicious

File Type:

LNK File - Malicious

Link:

https://app.docguard.net/9d5dae158e928f5c8c49d92a462d932a7e39f7c76510ab11b666e4e2d5783ca0/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive lolbin masquerade scriptrunner

Link:

https://www.filescan.io/uploads/6ab62ff4dda5a6234d446ac6/reports/bbbea166-6b06-49d8-a626-2fa9d15f2ab9/overview

Verdict:

Suspicious

Labled as:

Troj/LnkObf

Link:

https://www.hybrid-analysis.com/sample/9d5dae158e928f5c8c49d92a462d932a7e39f7c76510ab11b666e4e2d5783ca0

Verdict:

Malicious

File Type:

lnk

First seen:

2026-09-24T05:18:00Z UTC

Last seen:

2026-09-26T22:07:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/9d5dae158e928f5c8c49d92a462d932a7e39f7c76510ab11b666e4e2d5783ca0/results?tab=lookup

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1978091

Signature

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Suspicious execution chain found

Windows shortcut file (LNK) starts blacklisted processes

Behaviour

Behavior Graph:

Download SVG

Verdict:

Malware

YARA:

3 match(es)

Tags:

Batch Command DeObfuscated Execution: PowerShell in LNK LNK Malicious PowerShell PowerShell Call T1027 T1059.001 T1204.002

Link:

https://app.malva.re/file/0dd946c9d4f5727c765526420d194425

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9d5dae158e928f5c8c49d92a462d932a7e39f7c76510ab11b666e4e2d5783ca0/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2026-09-25 06:20:25 UTC

File Type:

Binary

AV detection:

6 of 38 (15.79%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tvo24fmoskhvzdcj3evemlmtfj7dt56hmuikwenwm3sofvlyhsqa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery execution persistence

Link:

https://tria.ge/reports/260925-kbge4awyfv/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Kills process with taskkill

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

cURL User-Agent

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

System Binary Proxy Execution: ScriptRunner

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/9d5dae158e928f5c8c49d92a462d932a7e39f7c76510ab11b666e4e2d5783ca0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Archive_in_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies archive (compressed) files in shortcut (LNK) files.

Rule name:	Long_RelativePath_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies shortcut (LNK) file with a long relative path. Might be used in an attempt to hide the path.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample