Forensia: Free Threat Intelligence Lookup

FORENSIA

Indicator investigation

warming up…

Resolving indicator evidenceacquiring

Loading verdict, provenance, relationships and sightings.

Opening Forensia workspaceacquiring

Loading the current evidence view. Navigation and account controls remain available.

Loading recent evidenceacquiring

Verdict

MENTIONED — 1 report, unverified

What is this: Malware file — family not identified.
Should you care: Weak signal — mentioned in 1 report, not corroborated across feeds.
What to do: No action — weak signal.

OBSERVEDLIMITED EVIDENCE COVERAGEDeterministic · stored evidence only

Malware file investigation

Observed file hash with incomplete classification

Forensia has observed this file hash, but available evidence does not establish a malware family or behavior. A hash match proves byte identity only; it is not a verdict without trustworthy provenance.

File classification

Observed file hash

Classification is bounded to named stored sources.

Malware family

No family attribution

No family name is asserted from generic tags.

File profile

SHA-256 · type unavailable

No bounded behavior category is available from stored tags.

Source corroboration

1 distinct connector

1 polling citation is shown separately and not treated as independent evidence.

Related evidence

1 report mention

Only persisted same-file edges, YARA matches, and exact report mentions count here; generic file-type co-tags are excluded.

Observation window

2026-05-15 → 2026-05-15

These are first and last local feed observations, not file creation or execution times.

What the evidence supports

Findings stay bounded to named sources and observable infrastructure.

1 finding

Mentioned in 1 local intelligence report

HIGH

Kazuar: Anatomy of a nation-state botnet

Exact hash match in locally ingested report title/body

Read the report for scope and publication date before applying its conclusions to this sample.

What remains unknown

No source-backed malware family attribution is available; Forensia will not derive one from generic file tags.
No stored YARA match or sandbox behavior trace describes what the file does at runtime.
No source-backed ATT&CK technique mapping is attached to this file.
Current prevalence, execution in your environment, and whether the sample is still distributed are not established by a hash lookup.
Command-and-control infrastructure is not asserted unless an exact report or persisted relationship supplies it.

reports · 1 connectors · 1

Graph preview

Neighborhood topology. Open the graph for interactive pivots.

Open full investigation canvas →

Building relationship previewacquiring

Loading connected indicators, reports and entities.

Continue investigation

High-signal pivots without leaving the thread you started in search.

Related alerts, reports, and entities
Structured pivots from local graph context.
Open in graph
Full investigation canvas with neighbor expansion.