Documents.lnk

Classification: Malicious

Documents.lnk is a trojan (application/octet-stream). Detected by 29 antivirus engines. Linked to Bazar malware.

Detection summary

  • 29 antivirus detections
  • 0 IDS alerts
  • 0 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: BAZAR (S0534)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
BazaLoader MalwareBazaar Abuse.ch 2021-12-15 09:48:02 2021-12-15 09:48:02 malicious-activity S0534 Bazar
BazaLoader Abuse.ch 2021-12-15 09:48:02 2021-12-15 09:48:02 malicious-activity S0534 Bazar

Sample information

Filenames
Documents.lnk
File type
application/octet-stream
MD5
cafb938a4d0c54ea8da24ae96d2caa14
SHA-1
bd909bc904c74188db9598109e4b1a7c53b68254
SHA-256
a6b84713ffadc978cdb852b9af836266f22b8b9294f80af928f82c565401d367
First indexed
2021-12-15 11:15:10
Last updated
2026-10-12 01:20:47

Antivirus detections

EngineDetection
CyrenLNK/Agent.AB.gen!Eldorado
ESET-NOD32LNK/Agent.MI
CynetMalicious (score: 99)
SophosTroj/LnkRun-AO
IkarusTrojan.LNK.Agent
AviraLNK/Runner.VPCI
AhnLab-V3LNK/Autorun.Gen
VBA32Trojan.Link.CmdRunner
ZonerProbably Heur.LNKScript
F-SecureTrojan:W32/LnkGen.C
GDataWin32.Trojan.Agent.79YOEY
ALYacTrojan.GenericKD.47660055
AVGOther:Malware-gen [Trj]
Ad-AwareTrojan.GenericKD.47660055
ArcabitTrojan.Generic.D2D73C17
AvastOther:Malware-gen [Trj]
BitDefenderTrojan.GenericKD.47660055
ComodoTrojWare.Win32.Agent.vdcwi@0
EmsisoftTrojan.GenericKD.47660055 (B)
FireEyeTrojan.GenericKD.47660055
GDataTrojan.GenericKD.47660055
LionicTrojan.WinLNK.Generic.4!c
MAXmalware (ai score=80)
McAfeeLNK/Agent-FPW!CAFB938A4D0C
MicroWorld-eScanTrojan.GenericKD.47660055
MicrosoftTrojan:Win32/WinLNK!MTB
SymantecTrojan.Gen.NPE
TrendMicroTROJ_FRS.0NA103LG21
TrendMicro-HouseCallTROJ_FRS.0NA103LG21