MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b052a022dfefb71b3888349bd02b9627b8e3fecffc96295ca0496eba084020a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	0b052a022dfefb71b3888349bd02b9627b8e3fecffc96295ca0496eba084020a
SHA3-384 hash:	337658b654acd41d72553e64ba200ad886c6d74e7ee9eaaea95f80b0d55fab5b87c99e2da776f038f836db2be7bf2416
SHA1 hash:	309f41f2cbd1db597f00990f7c83296d2f17906c
MD5 hash:	4e329764e307a45f05f1604622753a54
humanhash:	magazine-muppet-uniform-november
File name:	Additional_WB_Unit_1_ _Unit_2_grammar_exercises_with_answer_key.docx
Download:	download sample
File size:	343'441 bytes
First seen:	2026-10-21 21:23:02 UTC
Last seen:	Never
File type:	doc
MIME type:	application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep	6144:UQCygMCeBOFs9+qkvbGo15lSjCmCOZNYWtsSEB9fEUuGzRsa7C:715BOI+q0z15MjxZKWEzoGzRDC
TLSH	T1D674238AB74D0F55D726A03B2BB788ECA572121D04334A0D595AF7CC8B07BB651B8F1E
TrID	52.2% (.DOCX) Word Microsoft Office Open XML Format document (23500/1/4) 38.8% (.ZIP) Open Packaging Conventions container (17500/1/4) 8.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	docx
Reporter	TomU
Tags:	doc

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

Embedded Images

MalwareBazaar found the following images embedded in this file:

MD5 hash	dc.creator	# of relations
72073dfa17845244870e90204f45a457	Jorunn Hakkaart	None

Intelligence

File Origin

# of uploads :

# of downloads :

167

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

MSO

Details

Link:

https://research.acce.ciphertechsolutions.com/results/12d78a89-b6ce-4656-88c1-20a6ee2ee890/

Malware family:

n/a

ID:

File name:

doc

Verdict:

No threats detected

Analysis date:

2026-10-21 21:32:56 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/c6d3c226-038a-4154-9b15-e12bb57b1868

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Legit

File type:

application/msword

Has a screenshot:

False

Contains macros:

False

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad92d545a22ac805bd92499

Tags:

n/a

Result

Verdict:

Clean

File Type:

OOXML Word File

Link:

https://app.docguard.net/0b052a022dfefb71b3888349bd02b9627b8e3fecffc96295ca0496eba084020a/results/dashboard

Document image

Image:

Download PNG

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/0b052a022dfefb71b3888349bd02b9627b8e3fecffc96295ca0496eba084020a

Label:

Benign

Suspicious Score:

/10

Score Malicious:

Score Benign:

Link:

https://www.malware.ai/gui/files/?id=d65109ed-56f5-41fc-8d7d-8eefaf318ea4

Verdict:

Unknown

File Type:

docx

Link:

https://opentip.kaspersky.com/0b052a022dfefb71b3888349bd02b9627b8e3fecffc96295ca0496eba084020a/results?tab=lookup

Verdict:

inconclusive

YARA:

2 match(es)

Link:

https://app.malva.re/file/4e329764e307a45f05f1604622753a54

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0b052a022dfefb71b3888349bd02b9627b8e3fecffc96295ca0496eba084020a/

Threat name:

Binary.Trojan.Generic

Status:

Suspicious

First seen:

2026-10-21 21:23:26 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

3 of 38 (7.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bmcsuarn735xdm4iqne32avzmj5y4p7m77ewffokasloxieeaifa._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/261021-z8meyafz4y/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/0b052a022dfefb71b3888349bd02b9627b8e3fecffc96295ca0496eba084020a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MULTI_Malware_Unknown_ForgeAuto_4f67e0b3_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)

Rule name:	weird_png_data_after_end Create hunting rule
Author:	Maxime THIEBAUT (@0xThiebaut)
Description:	Detects data suspiciously located after a PNG's end header
Reference:	https://www.bleepingcomputer.com/news/microsoft/windows-11-snipping-tool-privacy-bug-exposes-cropped-image-content/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

doc 0b052a022dfefb71b3888349bd02b9627b8e3fecffc96295ca0496eba084020a

(this sample)

Delivery method

Distributed via e-mail attachment

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample