MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02f1ee5e947db5bc92befa3c062e21592c5764775eee75c4b168f2466e1c1913. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 5

Maldoc score: 31

Intelligence 5 IOCs YARA 6 File information Comments

SHA256 hash:	02f1ee5e947db5bc92befa3c062e21592c5764775eee75c4b168f2466e1c1913
SHA3-384 hash:	0f2f5a5ae40f525b6242f6afdaccd5a535f9d8de4e7c554e33b33650c2320ee4b616c7dbb92e567bbf2c36c2a5b7fbcd
SHA1 hash:	040cbd9f5366207f28c30d38885d59d43044c6b9
MD5 hash:	19c10acbf84ea17e539ae22d48c3335c
humanhash:	oklahoma-robert-jersey-beryllium
File name:	SecuriteInfo.com.Trojan.DOC.Agent.AQZ.25245.24147
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	980'480 bytes
First seen:	2020-10-31 02:52:17 UTC
Last seen:	2020-10-31 06:50:14 UTC
File type:	docx
MIME type:	application/msword
ssdeep	12288:rfnUqJFzzQoDWI3BlUEtcY7jKYNX+KcswNtb3a:rfnjzQoDWIxyErvK+X+Kg+
TLSH	C625B3F3F8AA64B1C50B75FCC02929B51C9CAC876A10F4CEE44C675D32BD8A05D99E9C
Reporter	SecuriteInfoCom
Tags:	ZLoader

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 31

Application name is Microsoft Office Word

Office document is in OLE format

Office document contains VBA Macros

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	Document_Close	Runs when the Word document is closed
Hex String	.zm	0B2e7a6d
IOC	Reddit.vbs	Executable file name
IOC	Regsvr32.exe	Executable file name
IOC	Waveplate.dll	Executable file name
Suspicious	Open	May open a file
Suspicious	Write	May write to a file (if combined with Open)
Suspicious	CreateTextFile	May create a text file
Suspicious	Adodb.Stream	May create a text file
Suspicious	SaveToFile	May create a text file
Suspicious	shell	May run an executable file or a system command
Suspicious	WScript.shell	May run an executable file or a system command
Suspicious	CreateObject	May create an OLE object
Suspicious	Windows	May enumerate application windows (if combined with Shell.Application object)
Suspicious	Lib	May run code from a DLL
Suspicious	RtlMoveMemory	May inject code into another process
Suspicious	Chr	May attempt to obfuscate specific strings (use option --deobf to deobfuscate)
Suspicious	exec	May run an executable file or a system
Suspicious	Hex Strings	Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin

# of uploads :

# of downloads :

173

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.DOC.Agent.AQZ.25245.24147.UNOFFICIAL

MiscreantPunch.EXEInsideOfDoc.B64.1.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD.KERNEL32.200608B64.8.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Result

Threat name:

Unknown

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/517400

Signature

Benign windows process drops PE files

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document exploit detected (creates forbidden files)

Document exploit detected (process start blacklist hit)

Machine Learning detection for dropped file

Machine Learning detection for sample

Microsoft Office drops suspicious files

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Potential malicious VBS script found (has network functionality)

Sigma detected: Microsoft Office Product Spawning Windows Shell

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/02f1ee5e947db5bc92befa3c062e21592c5764775eee75c4b168f2466e1c1913/

Threat name:

Document-Word.Dropper.SDrop

Status:

Malicious

First seen:

2020-10-30 21:38:44 UTC

File Type:

Document

Extracted files:

AV detection:

17 of 29 (58.62%)

Threat level:

3/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=aly64xuupw23zev67i6amlrblewfozdxl3xhlrfrndzem3q4dejq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/201031-9xj8braxas/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks processor information in registry

Enumerates system info in registry

Office loads VBA resources, possible macro or embedded object present

Drops file in Windows directory

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Dropper

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/02f1ee5e947db5bc92befa3c062e21592c5764775eee75c4b168f2466e1c1913

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	IPPort_combo_mem Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	Ping_Del_method_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	cmd ping IP nul del

Rule name:	Select_from_enumeration Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	SharedStrings Create hunting rule
Author:	Katie Kleemola
Description:	Internal names found in LURK0/CCTV0 samples

Rule name:	UAC_bypass_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample