{
    "query_status": "ok",
    "data": [
        {
            "sha256_hash": "a96a077d02d5fe3524e3416adc88f09f3817099b617e552338f7c736758f242f",
            "sha3_384_hash": "5b454eb0035bb80a0f38e6e88ef8d56b0aef6f5c0440ab76c8b99204396c8c34e303fa6532e7aa46a13aa3cb826a3da6",
            "sha1_hash": "589a5923dfb3ed85301f3ce4a01b4f3351d647dd",
            "md5_hash": "3fdce08723365d5c06e1183585164118",
            "first_seen": "2026-03-30 16:46:29",
            "last_seen": null,
            "file_name": "PumpGuard_Pumpfun_AI_Attack_Defence_Requirements_v2_1_GameEngine (2).rar",
            "file_size": 5262,
            "file_type_mime": "application/x-rar",
            "file_type": "rar",
            "file_format": null,
            "file_arch": null,
            "reporter": "smica83",
            "origin_country": "HU",
            "anonymous": 0,
            "signature": "Kimsuky",
            "imphash": null,
            "tlsh": "T125B19E083AB0C2527B025D75C2F652FBA4568F0582D2F81682CCD23850AF57F94A27BF",
            "telfhash": null,
            "gimphash": null,
            "ssdeep": "96:aNEr0lu6K+T75Ur6/w6pqiLROIciH4TcH+chq/ZjYaD4HLiFAk7w5zm2scu:px6K+eArpqiL8Yd3hq/ZjB4HuFAtm2sR",
            "magika": "rar",
            "dhash_icon": null,
            "trid": [
                "61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)",
                "38.4% (.RAR) RAR compressed archive (gen) (5000/1)"
            ],
            "comment": null,
            "archive_pw": null,
            "tags": [
                "apt",
                "ITA",
                "Kimsuky",
                "rar"
            ],
            "code_sign": null,
            "delivery_method": null,
            "intelligence": {
                "clamav": [
                    "Legacy.Trojan.Agent-1388773",
                    "Sanesecurity.Foxhole.Lnk_Rar_1.UNOFFICIAL",
                    "Sanesecurity.Foxhole.Rar_fs852.UNOFFICIAL",
                    "Sanesecurity.Foxhole.Rar_pdf.UNOFFICIAL",
                    "TwinWave.EvilLNK.KingForADaypshell.20231121.UNOFFICIAL"
                ],
                "downloads": "96",
                "uploads": "1",
                "mail": null
            },
            "file_information": null,
            "ole_information": [],
            "yara_rules": null,
            "vendor_intel": {
                "CERT-PL_MWDB": {
                    "detection": null,
                    "link": "https://mwdb.cert.pl/sample/a96a077d02d5fe3524e3416adc88f09f3817099b617e552338f7c736758f242f/"
                },
                "YOROI_YOMI": {
                    "detection": "Malicious File",
                    "score": "1.00"
                },
                "ReversingLabs": {
                    "threat_name": "Win32.Trojan.Qwexlafiba",
                    "status": "MALICIOUS",
                    "first_seen": "2026-03-30 14:01:09",
                    "scanner_count": "24",
                    "scanner_match": "14",
                    "scanner_percent": "58.33"
                },
                "Spamhaus_HBL": [
                    {
                        "detection": "suspicious",
                        "link": "https://www.spamhaus.org/hbl/"
                    }
                ],
                "FileScan-IO": {
                    "verdict": "MALICIOUS",
                    "threatlevel": "1.0",
                    "confidence": "1.0",
                    "report_link": "https://www.filescan.io/uploads/69caa90e972c219c8d726e6d/reports/9cdc5640-8cc1-4197-9ec1-27b4b34d4ed1/overview"
                },
                "Kaspersky": {
                    "verdict": "Malware",
                    "file_type": "rar",
                    "first_seen": "2026-03-30T17:30:00Z",
                    "last_seen": "2026-03-30T17:55:00Z",
                    "hitscount": 10,
                    "report_link": "https://opentip.kaspersky.com/a96a077d02d5fe3524e3416adc88f09f3817099b617e552338f7c736758f242f/results?tab=lookup",
                    "detections": []
                }
            },
            "comments": null
        }
    ]
}