MALICIOUS — 081f20a56d11403fe1e9d92f6d6891567eae9d9895c553f322fed1165d3c5a72.zip

MALICIOUS — 081f20a56d11403fe1e9d92f6d6891567eae9d9895c553f322fed1165d3c5a72.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100). 4 of 54 detection engines flagged it.

Identification

• SHA-256: 081f20a56d11403fe1e9d92f6d6891567eae9d9895c553f322fed1165d3c5a72
• SHA-1: 38cad1f5737b716f73406ff512459a119709e4f5
• MD5: 66b5da235deb7ffc19be9c2300486f06
• ssdeep: 24:94SP7gcX4I0mP2ff7twhWIkdsFPRjMslmx/wS32Ks7WSOT:9j7gq10pf52WIUs1cx/O7sT
• TLSH: T17412F7702CC06648CF55017A2E1C5ECFD26A04DB0A2102343D1C9B6AC00668F7ADC967
• Submitted as: 081f20a56d11403fe1e9d92f6d6891567eae9d9895c553f322fed1165d3c5a72.zip
• File type: zip · Size: 919 bytes
• Verdict: malicious (89/100)

Source: MalwareBazaar · first seen 2026-08-03T00:00:00.000Z · SHA-256 verified

Detections (4 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV feed: SaneSecurity foxhole_generic: Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL
• Microsoft Defender: Trojan:Win32/WinLNK.HGQ!MTB
• Kaspersky (KVRT): HEUR:Trojan.WinLNK.Rufus.gen

Why this verdict

The malicious score of 89/100 is the fusion of 3 weighted signals:

• ClamAV feed: SaneSecurity foxhole_generic flagged Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL (rule Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Archive contains executables: DOC-DPJHRH.lnk - static signal, weight 0.25, confidence 0.50

Archive contents (1 executable)

This zip carries 1 extracted member, each analyzed as its own sample:

• DOC-DPJHRH.lnk - beccb8c7ba1d4a95c1b159310f76244a4543989e16ad84f45380a4daae8efec9

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report