MALICIOUS — 02446fafa0689bf9aa4cf21fd9616536c2ea2c9ef5d4f5f656eba22f27ef199d.zip

MALICIOUS — 02446fafa0689bf9aa4cf21fd9616536c2ea2c9ef5d4f5f656eba22f27ef199d.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100). 4 of 54 detection engines flagged it.

Identification

• SHA-256: 02446fafa0689bf9aa4cf21fd9616536c2ea2c9ef5d4f5f656eba22f27ef199d
• SHA-1: 7564dcefcf167da0c04faf246efa917ee242492d
• MD5: d00cc3be57f0718d01321c954e63f2d2
• ssdeep: 12:5jyyRiMOUEvj6UdEmQlNODAawrq1QO8Qg7VJ9hVBLxc3wUBM7iMOU+Jaa:9yyRihUEWUdLwH7raQOwnBU3lBM7ihUa
• TLSH: T1ED0F0299B871AC53D5BF6BC6AAA9D0CFAB41242A45B01848D532A1A141089877119D1C
• Submitted as: 02446fafa0689bf9aa4cf21fd9616536c2ea2c9ef5d4f5f656eba22f27ef199d.zip
• File type: zip · Size: 628 bytes
• Verdict: malicious (87/100)

Source: MalwareBazaar · first seen 2026-08-03T00:00:00.000Z · SHA-256 verified

Detections (4 of 54 engines)

• ClamAV feed: SaneSecurity foxhole_generic: Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL
• Microsoft Defender: Trojan:Win32/Ravartar!rfn
• Emsisoft (Emergency Kit): Trojan.GenericKD.81018755
• Kaspersky (KVRT): HEUR:Trojan.WinLNK.Agent.gen

Why this verdict

The malicious score of 87/100 is the fusion of 2 weighted signals:

• ClamAV feed: SaneSecurity foxhole_generic flagged Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL (rule Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Archive contains executables: Contrato_Indeniza_Brasil-T22G18.lnk - static signal, weight 0.25, confidence 0.50

Archive contents (1 executable)

This zip carries 1 extracted member, each analyzed as its own sample:

• Contrato_Indeniza_Brasil-T22G18.lnk - 8293efe2cf2ceac6ac49eb8ea42c7d0d69326ec6743eed589e08d1d493520d96

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report