MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3158dfeb7798bd3de8634b22a439e58a58e81bd97ce84d6379441079156ab7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3158dfeb7798bd3de8634b22a439e58a58e81bd97ce84d6379441079156ab7a
SHA3-384 hash: cd45c6333136d8de2d9d14bbfa173f4d70c9d434cebfc1fe333294958830953ab40df28a3104ae92aa333d80f6c9c599
SHA1 hash: 231b63912f9935c9d3927ea6998d89a6ead9aefc
MD5 hash: daa31b68aa597dd4938bba8a216614e3
humanhash: fifteen-kilo-burger-whiskey
File name:uat.lnk
Download: download sample
File size:1'557 bytes
First seen:2026-03-30 17:31:39 UTC
Last seen:Never
File type:Shortcut (lnk) lnk
MIME type:application/x-ms-shortcut
ssdeep 12:8x0C3pQVe/4VGXJMn0V+fIlVlDmo0I6DmNJcfh7Ek7+lbYZJl:8xFpQQ7bV+fk4o0Cuh7E+abq
TLSH T132317D0C4FD50A14D3738D366457E301C8257422ED43EF2D02D1509C2866511FA3AF6F
Magika lnk
Reporter abuse_ch
Tags:lnk

Intelligence

File Origin
# of uploads :
1
# of downloads :
35
Origin country :
SE SE
Vendor Threat Intelligence
Gathering data
Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69cab39f3a18a6e1ddefd13c
Tags:
infosteal spawn
Result
Verdict:
Clean
File Type:
LNK File
Link:
https://app.docguard.net/b3158dfeb7798bd3de8634b22a439e58a58e81bd97ce84d6379441079156ab7a/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
cscript lolbin
Link:
https://www.filescan.io/uploads/69cab39e972c219c8d727a41/reports/bbbf0d00-0f9f-44b2-895f-ead8a797be93/overview
Verdict:
Malicious
Labled as:
TrojanDownloader/LNK.Agent
Link:
https://www.hybrid-analysis.com/sample/b3158dfeb7798bd3de8634b22a439e58a58e81bd97ce84d6379441079156ab7a
Result
Gathering data
Verdict:
Clean
File Type:
lnk
Link:
https://opentip.kaspersky.com/b3158dfeb7798bd3de8634b22a439e58a58e81bd97ce84d6379441079156ab7a/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1891066
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1891066 Sample: uat.lnk Startdate: 30/03/2026 Architecture: WINDOWS Score: 48 10 Multi AV Scanner detection for submitted file 2->10 6 cscript.exe 1 2->6         started        process3 process4 8 conhost.exe 1 6->8         started       
Verdict:
Malware
YARA:
2 match(es)
Tags:
LNK LNK: Script Execution Malicious T1218
Link:
https://app.malva.re/file/daa31b68aa597dd4938bba8a216614e3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3158dfeb7798bd3de8634b22a439e58a58e81bd97ce84d6379441079156ab7a/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/b3158dfeb7798bd3de8634b22a439e58a58e81bd97ce84d6379441079156ab7a
Threat name:
Shortcut.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-03-30 12:57:01 UTC
File Type:
Binary
AV detection:
4 of 36 (11.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wmky37vxpgf5hxuggszcuq46lcsy5an5s7hijvrxsraqpekwvn5a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/260330-v4dj1set8z/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.13
Link:
https://yomi.yoroi.company/submissions/b3158dfeb7798bd3de8634b22a439e58a58e81bd97ce84d6379441079156ab7a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Script_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies scripting artefacts in shortcut (LNK) files.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Shortcut (lnk) lnk b3158dfeb7798bd3de8634b22a439e58a58e81bd97ce84d6379441079156ab7a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3562403/
  
Delivery method
Distributed via web download

Comments