MALICIOUS — 0585547fd8fb93a98ff616249edfa78f28e2d0a57c56a8453d39c418935bf79a.lnk

MALICIOUS — 0585547fd8fb93a98ff616249edfa78f28e2d0a57c56a8453d39c418935bf79a.lnk is a lnk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the WinLNK family. 3 of 51 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 0585547fd8fb93a98ff616249edfa78f28e2d0a57c56a8453d39c418935bf79a
SHA-1: ca6f554b63f0fbc7f71d4940a71386619e5429c7
MD5: 65282efc7cdef83801f918acf05762ce
ssdeep: 12:8Ysl30m/VnEXzZURl2+UIGfw4n8VIGN7dZplX:8FJtnyUD2+hlrhZdZ7
TLSH: T1A10FE5CF930C4752CB2DC9B2061D61FCB582309142AA770E2E2D293A25B601F9C9162E
Submitted as: 0585547fd8fb93a98ff616249edfa78f28e2d0a57c56a8453d39c418935bf79a.lnk
File type: lnk · Size: 639 bytes
Verdict: malicious (99/100) · Family: WinLNK

Source: MalwareBazaar · first seen 2026-07-31T00:00:00.000Z · SHA-256 verified

Detections (3 of 51 engines)

Microsoft Defender: Trojan:Win32/WinLNK.PADL!MTB
Emsisoft (Emergency Kit): Trojan.Generic.40317494
Kaspersky (KVRT): HEUR:Trojan.WinLNK.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

2 behavioral detection(s): LOLBin: mshta executing remote/scripted payload [high] (rule tl-lolbin-mshta) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 4 finding(s), e.g. RWX/private injected region in svchost.exe (pid 932) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/WinLNK.PADL!MTB (rule Trojan:Win32/WinLNK.PADL!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Generic.40317494 (rule Trojan.Generic.40317494) - engine signal, weight 0.55, confidence 0.85
Shortcut launches: embedded-url - static signal, weight 0.50, confidence 0.80
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 32 external host(s) at runtime (13 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

16491 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

5b6dabf5d72fe9e2ae845e106cd7529ae3e08708acbec049ec75c148c907a236 - 5b6dabf5d72fe9e2ae845e106cd7529ae3e08708acbec049ec75c148c907a236
ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49 - ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786285470&P2=404&P3=2&P4=cpbi6NWCBebfgLjVwFrj2UkRym9uh8jtv7sm1qbQLrqLU4Dbc2G4tMpxVM2Jw%2bWsO8esnjJggr4JoOv4l1AVfQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786285543&P2=404&P3=2&P4=NkIUD2GN23w97krg1xPDa%2f5XkZSv9Hf%2bedCAcEaazQyUiiUrl5hGwYKduPv069eilRJYxV3ekc5w9vYwvNZyeQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
https://pdf-bro.lat/h/estagio1.php?r=360761F15794

Embedded domains

pdf-bro.lat

Embedded IP addresses

4.150.223.101
52.123.252.234
4.247.188.224
4.230.171.124
52.253.84.76
135.233.95.135
74.178.76.128
52.182.141.63
135.233.45.222
92.223.78.30
40.79.141.155
135.234.160.245
203.26.79.13
52.123.252.197
74.179.71.159
72.145.35.115
57.155.104.224
52.148.114.188
52.110.12.24
52.110.12.31

More WinLNK samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report