MALICIOUS — IMG_20260728_232656.jpg.lnk

MALICIOUS — IMG_20260728_232656.jpg.lnk is a lnk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Phonzy family. 3 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: e32d7ba3858acd2f13cdc52d0b75ac366b30ee32c5abc18a8796d896090ca1d8
• SHA-1: e608e9443233389c5264d853cd584123e9367107
• MD5: ded2f7cea1f57f7d5cf5b74b7e626654
• ssdeep: 24:8qwdmGjMDvSwjKUaWU3AcPWkp+/CWhyA+Ndtnr4I0WK6c/6Cab7Oa7m:89meKpUQpyDN3UIA6q6Cax
• TLSH: T18013AC8D522CD346CB7ADD21D8BDA46E808335616AB47D0D5C4F403E28E351BDDF0286
• Submitted as: IMG_20260728_232656.jpg.lnk
• File type: lnk · Size: 1399 bytes
• Verdict: malicious (93/100) · Family: Phonzy

Detections (3 of 51 engines)

• Microsoft Defender: Trojan:Script/Phonzy.B!ml
• Emsisoft (Emergency Kit): Trojan.Generic.40346811
• Kaspersky (KVRT): HEUR:Trojan.Multi.Powedon.a

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 93/100 is the fusion of 5 weighted signals:

• Memory forensics: 3 finding(s), e.g. RWX/private injected region in svchost.exe (pid 952) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged Trojan:Script/Phonzy.B!ml (rule Trojan:Script/Phonzy.B!ml) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Generic.40346811 (rule Trojan.Generic.40346811) - engine signal, weight 0.55, confidence 0.85
• Shortcut launches: powershell - static signal, weight 0.50, confidence 0.80
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

1786 behavior events · 1 ATT&CK techniques · 2 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/5604/files/55c8f4d8b705cad478e4111c2391bf831b2fc298b1319ee38deddbde3b150092 - 55c8f4d8b705cad478e4111c2391bf831b2fc298b1319ee38deddbde3b150092
• /opt/CAPEv2/storage/analyses/5604/files/e32d7ba3858acd2f13cdc52d0b75ac366b30ee32c5abc18a8796d896090ca1d8 - e32d7ba3858acd2f13cdc52d0b75ac366b30ee32c5abc18a8796d896090ca1d8

File paths

• C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

More Phonzy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report