Documents.lnk
Classification: Malicious
Documents.lnk is a trojan (application/octet-stream). Detected by 24 antivirus engines. Linked to Bazar malware. Reported by Abuse.ch, last seen 2021-12-03.
Detection summary
- 24 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: BAZAR (S0534)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| BazaLoader | Abuse.ch | 2021-12-03 09:53:03 | 2021-12-03 09:53:03 | malicious-activity | S0534 Bazar |
Sample information
- Filenames
- Documents.lnk
- File type
- application/octet-stream
- MD5
18a26a82a0124ab7cdfbe5f382b3ae73- SHA-1
bddd521e70fd1bcb73851c0066a300fc7ee8f37f- SHA-256
2cedfe4b448f24f319576a28240782ab9c3abc7f61182ef28e82cfb42bbc5621- First indexed
- 2021-12-03 11:15:08
- Last updated
- 2026-05-22 02:09:04
Antivirus detections
| Engine | Detection |
|---|---|
| Avira | LNK/Runner.VPCI |
| Cynet | Malicious (score: 99) |
| AhnLab-V3 | LNK/Autorun.Gen |
| VBA32 | Trojan.Link.CmdRunner |
| Zoner | Probably Heur.LNKScript |
| ALYac | Trojan.GenericKD.38175219 |
| AVG | Other:Malware-gen [Trj] |
| Ad-Aware | Trojan.GenericKD.38175219 |
| Arcabit | Trojan.Generic.D24681F3 |
| Avast | Other:Malware-gen [Trj] |
| BitDefender | Trojan.GenericKD.38175219 |
| Comodo | .UnclassifiedMalware@0 |
| DrWeb | LNK.Starter.59 |
| ESET-NOD32 | LNK/Agent.MI |
| Emsisoft | Trojan.GenericKD.38175219 (B) |
| FireEye | Trojan.GenericKD.38175219 |
| GData | Trojan.GenericKD.38175219 |
| Ikarus | Trojan.LNK.Agent |
| Lionic | Trojan.WinLNK.Generic.4!c |
| MAX | malware (ai score=85) |
| MicroWorld-eScan | Trojan.GenericKD.38175219 |
| Sophos | Troj/LnkRun-AO |
| TrendMicro | Trojan.LNK.STARTER.AUSLRW |
| TrendMicro-HouseCall | Trojan.LNK.STARTER.AUSLRW |