MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a34ca695a121a9757c72fc0b78101eefba974896da6913d87c2a0575d15bc9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a34ca695a121a9757c72fc0b78101eefba974896da6913d87c2a0575d15bc9f
SHA3-384 hash: 17c2ae5b17f3e4089d6dc98e8243b6731cdf61d9496d3ee97971f3eb60e49aaa41453f5fcd9e623650847d99fe669c49
SHA1 hash: 7d82e6b9f0821806bdb1d20a9fdd8c1576059843
MD5 hash: 4bc433a2119001680cf41b0f452f1765
humanhash: hamper-oranges-six-tango
File name:hipsaver.doc.03.23.one
Download: download sample
Signature IcedID
Create hunting rule
File size:258'256 bytes
First seen:2023-03-24 06:37:30 UTC
Last seen:Never
File type:Word file doc
MIME type:application/octet-stream
ssdeep 6144:PkIk+ai6laI6ggUOqa1fmioLyVmWgs6kI:kaI6jF1fmYESu
TLSH T18E44F193841A185BD9A3877C8DE24B18FB1BC8C18346CF6D7D9160AA1D2F3B3D857A4D
Reporter abuse_ch
Tags:BR-2963 doc Gozi one Ursnif

Intelligence

File Origin
# of uploads :
1
# of downloads :
882
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
hipsaver.doc.03.23.one
Verdict:
No threats detected
Analysis date:
2023-03-24 06:40:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/495d0f2a-09b7-4e75-9882-a4b93ab76986

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Sanesecurity.Malware.28788.Heur.BadOne.cmd.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.OneNotePkillExeExtDetonationRulingTheNation.20230125.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.OneNote.IRememberDamage.20230321.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/641d454db270ef3bdbe3d740/reports/68daf452-f734-4afc-8b21-a3e5aae6dc98/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/0a34ca695a121a9757c72fc0b78101eefba974896da6913d87c2a0575d15bc9f
Result
Verdict:
MALICIOUS
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1201003
Signature
Yara detected Malicious OneNote
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a34ca695a121a9757c72fc0b78101eefba974896da6913d87c2a0575d15bc9f/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-03-24 06:38:17 UTC
File Type:
Document
AV detection:
2 of 37 (5.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bi2mu2k2cinjov6hf7alpaib5352s5ejnwtjcpmhykqfoxivxspq._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/230324-hd3p1aeg7y/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Drops file in Program Files directory
Drops file in Windows directory
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:OneNote_magic
Create hunting rule
Author:Stuart Gonzalez
Rule name:SUSP_OneNote
Create hunting rule
Author:spatronn
Description:Hard-Detect One

File information

The table below shows additional information about this malware sample such as delivery method and external references.

IcedID

Word file doc 0a34ca695a121a9757c72fc0b78101eefba974896da6913d87c2a0575d15bc9f

(this sample)

IcedID

Executable exe 244e55adeb71ae1cbd57af87dd4fa0c2f1143233ffddf254da27a721c61a63c4

  
Dropping
SHA256 244e55adeb71ae1cbd57af87dd4fa0c2f1143233ffddf254da27a721c61a63c4
  
Dropping
MD5 dbc6378ee7fb86000809b779d98fcec1

Comments