🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c71e3a48ae93fba3a407d04430cf13234c843a10caa7b64081115c7b5aec89f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c71e3a48ae93fba3a407d04430cf13234c843a10caa7b64081115c7b5aec89f4
SHA3-384 hash: d0ec22616f51a35ef630e2f33905309af724155f9b6de02d8701705c074bca51683e7af4bce451c3adb0ddd00bb555b4
SHA1 hash: 7b9c04dfae43a2b5d7da408caf65049c5221f98f
MD5 hash: de1ed40a5ee058ead6d0c4525977e7ce
humanhash: solar-wisconsin-lima-london
File name:Royal_Commendation_and_Directives_2026.zip
Download: download sample
File size:182'373 bytes
First seen:2026-09-24 20:03:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:xn3NWR5gqrgpqfVVMWmO1a5U4VcOUClYBIuJEjHC0a7mhsXw:N3N5qMpeFmfGFClY2u6bC0aiv
TLSH T1400413C6DE29D70CDE2F3D76014666C1F2FC6698D7236A2C6173ABD60C497820D1B19B
Magika zip
Reporter smica83
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
HU HU
File Archive Information

This file archive contains 7 file(s), sorted by their relevance:

File name:Royal_Commendation_and_Directives_2026.pdf.lnk
File size:1'971 bytes
SHA256 hash: a4d9612553aa19b4eb23133d14e20acb5648f86fdb7c2311f18bf14d533054e0
MD5 hash: e05a5f2d4257f84fe9584409fc6a31ef
MIME type:application/octet-stream
File name:mFGtDjuCcFv.doc
File size:39'888 bytes
SHA256 hash: f32475555319e395be2135c2b1c8c42e6f0ce8797f4cffe4dbf1117475671ee5
MD5 hash: 941143384ffda3e82e8820f08983d18b
MIME type:application/x-dosexec
File name:veyTQvhP.doc
File size:165'824 bytes
SHA256 hash: 7a3b2bcab55f340203638fdb6af2c9ed2a7ee99f025c205b3219fd91fcb4a811
MD5 hash: 3c36c852b36904353fe3c6e2d56978dc
MIME type:application/x-dosexec
File name:yHskyQfH.doc
File size:8'755 bytes
SHA256 hash: ca8ec8c68f1a0ed212ea8467c255be9014a5e60f3789ac6180966a6ebb841e66
MD5 hash: f647c11c1f47379ee3c8fec8a1399ab0
MIME type:application/octet-stream
File name:OrMUUcfsx.doc
File size:48 bytes
SHA256 hash: cc36eb25769c923abf92ffe05d0596ee4ec822ff13cbb6f63ed91417e1dcf4f5
MD5 hash: 331ebe58f6ef0e922930686288d7fd07
MIME type:application/x-dosexec
File name:Royal_Commendation_and_Directives_2026.pdf
File size:26'104 bytes
SHA256 hash: b8ab98fd56b8e0df304465b79c9eb06571ed2c0b0e81000661e7c22145214033
MD5 hash: 7a795276dbba68e2db25c152af520875
MIME type:application/pdf
File name:F
File size:797 bytes
SHA256 hash: 45b4e6aa9acee024ccf803c48cb718a21b79006e1a82e19a62fa72a63975608f
MD5 hash: 09917a62ddfaf0f6e491d27b43c314e2
MIME type:text/plain
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/d4f28ee9-cdbd-4d57-8d29-36b644a767ac/
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Win.Trojan.Suspect-34
Create hunting rule

Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6acdf99b7378c656ff4d9297
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c71e3a48ae93fba3a407d04430cf13234c843a10caa7b64081115c7b5aec89f4
Verdict:
Malicious
File Type:
zip
First seen:
2026-09-12T23:16:00Z UTC
Last seen:
2026-09-25T17:42:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/c71e3a48ae93fba3a407d04430cf13234c843a10caa7b64081115c7b5aec89f4/results?tab=lookup
Score:
2%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/c71e3a48ae93fba3a407d04430cf13234c843a10caa7b64081115c7b5aec89f4
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
LNK Zip Archive
Link:
https://app.malva.re/file/de1ed40a5ee058ead6d0c4525977e7ce
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c71e3a48ae93fba3a407d04430cf13234c843a10caa7b64081115c7b5aec89f4/
Threat name:
Win32.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-09-24 20:03:20 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
10 of 38 (26.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y4pdusfosp52hjah2bcdbtytengiioqqzkt3mqebcfohwwxmrh2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c71e3a48ae93fba3a407d04430cf13234c843a10caa7b64081115c7b5aec89f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:apt_redhotel_maliciouslnk_strings
Create hunting rule
Author:Sekoia.io
Description:Detects RedHotel's malicious LNKs
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Download_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies download artefacts in shortcut (LNK) files.
Rule name:PDF_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies Adobe Acrobat artefacts in shortcut (LNK) files. A PDF document is typically used as decoy in a malicious LNK.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments