MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a031746cb9e7f1a2fa8ffa5201de26e548e26d8b8e4195724d4dfde062c2a852. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a031746cb9e7f1a2fa8ffa5201de26e548e26d8b8e4195724d4dfde062c2a852
SHA3-384 hash: 8eff44852668c4f770dc02aa10139b3698f9b83c0977af0dcf6cb49fa1ee8561ffa48a76b3acc9406e483c4098706fbd
SHA1 hash: 820d4cb721067f8fa7dab0d12a9f145584ed4a40
MD5 hash: 6e169321964da0f4ecbb79cc86a965b4
humanhash: mars-september-indigo-five
File name:invoice111 - Shortcut.lnk
Download: download sample
File size:2'829 bytes
First seen:2025-04-23 08:07:39 UTC
Last seen:2025-04-23 08:07:56 UTC
File type:Shortcut (lnk) lnk
MIME type:application/x-ms-shortcut
ssdeep 48:8/HFWoVBtDIkyDM7CRj7c2JnSva2s3RpKS6URwGv2HRpK30:8dRVBtDaDMMjICnSvaNhpKrWbv4pKk
TLSH T169519D0237F55B12E2F6AB707EB6C8B24B353C93A881CA5D4211401E2872E188D65F7B
Magika lnk
Reporter abuse_ch
Tags:lnk WsgiDAV

Intelligence

File Origin
# of uploads :
2
# of downloads :
79
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.31259.LnkHeur.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.CrimeFlareInternetWreckage.20240723.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.CrimeFlareInternetWreckage.20240814.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6808a13f3d067f8483984ec4
Tags:
n/a
Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/a031746cb9e7f1a2fa8ffa5201de26e548e26d8b8e4195724d4dfde062c2a852/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade webdav
Link:
https://www.filescan.io/uploads/68089ff990767142c3e16fc6/reports/332e72b2-384f-4108-9581-6f0451e7dc00/overview
Verdict:
Suspicious
Labled as:
Troj/DownLnk
Link:
https://www.hybrid-analysis.com/sample/a031746cb9e7f1a2fa8ffa5201de26e548e26d8b8e4195724d4dfde062c2a852
Result
Threat name:
MalLnk
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1671808
Signature
Multi AV Scanner detection for submitted file
Yara detected malicious lnk
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a031746cb9e7f1a2fa8ffa5201de26e548e26d8b8e4195724d4dfde062c2a852/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uayxi3fz47y2f6up7jjadxrg4veoe3mlrzazk4snjx66aywcvbja._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250423-j1q56assav/
Behaviour
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a031746cb9e7f1a2fa8ffa5201de26e548e26d8b8e4195724d4dfde062c2a852

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Script_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies scripting artefacts in shortcut (LNK) files.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Shortcut (lnk) lnk a031746cb9e7f1a2fa8ffa5201de26e548e26d8b8e4195724d4dfde062c2a852

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3522232/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3522589/

Comments