MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0dffd50f5e61eaed6623498e1215b1d4d9c16910e996a25231fc9732ea5735c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Emotet (aka Heodo)


Vendor detections: 14


Maldoc score: 7


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0dffd50f5e61eaed6623498e1215b1d4d9c16910e996a25231fc9732ea5735c9
SHA3-384 hash: 70b40579044d3b40cc0cf8e235d34090c62ecb0f1d699cf4c659e296eee55ab54de7acdbc02b0dea42a2cff8658bc3b1
SHA1 hash: f659743d7d94a73aa834320aa1c1ddd6e03d5d58
MD5 hash: 973238bedecdf9fa59a9502aa5cedfc3
humanhash: bacon-timing-video-cold
File name:imedpub.com.xls
Download: download sample
Signature Heodo
Create hunting rule
File size:78'275 bytes
First seen:2022-01-27 14:34:54 UTC
Last seen:2022-01-30 16:58:47 UTC
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz
TLSH T112735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667
Reporter TeamDreier
Tags:Emotet Heodo xls

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 7
OLE dump

Intelligence

File Origin
# of uploads :
5
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
imedpub.com.xls
Verdict:
Malicious activity
Analysis date:
2022-01-27 22:40:51 UTC
Tags:
macros macros40 emotet-doc emotet trojan
Link:
https://app.any.run/tasks/900444f3-adfe-4b83-9bb6-a7cc1b67fbfa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/vnd.ms-excel
Has a screenshot:
False
Contains macros:
True
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/224370/
Detection(s):
SecuriteInfo.com.Macro.Downlader-9.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.Excel4DragoTrainingMontage.20210204.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.XLSLOLBINHammerToFall.20201218.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.XL4MDottedQuadDancingInHeaven.20210421.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.Emotet46and2.20220124.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Sending a custom TCP request
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Launching a process
Running batch commands by exploiting the app vulnerability
Sending an HTTP GET request to an infection source
Result
Verdict:
Malicious
File Type:
Legacy Excel File
Link:
https://app.docguard.net/0dffd50f5e61eaed6623498e1215b1d4d9c16910e996a25231fc9732ea5735c9/results/dashboard
Payload URLs
URL
File name
http://91.240.118.168/zzx/ccv/fe.html
Macro1
Document image
Image:
Download PNG
Document image
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd cmd.exe macros macros-on-open mshta mshta.exe print.exe stripped
Link:
https://www.filescan.io/uploads/61f2adab20a5f4d327d41fbb/reports/b5abd6f7-7441-49d9-80c2-aa95bb871dea/overview
Label:
Malicious
Suspicious Score:
5.7/10
Score Malicious:
57%
Score Benign:
43%
Link:
https://www.malware.ai/gui/files/?id=e6767886-81db-4a16-9c27-7848b9a46635
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/0dffd50f5e61eaed6623498e1215b1d4d9c16910e996a25231fc9732ea5735c9
Details
Excel 4.0 Macro
Document contains Excel 4.0 macros (XLM). A valid, albeit dated feature, this document should be treated with suspicion.
IPv4 Dotted Quad URL
A URL was detected referencing a direct IP address, as opposed to a domain name.
Macro Execution Coercion
Detected a document that appears to social engineer the user into activating embedded logic.
MSHTA Pivot
Macro may contain a pivot to an external URL resource via MSHTA.
Autostarting Excel Macro Sheet
Excel contains Macrosheet logic that will trigger automatically upon document open.
Result
Threat name:
Hidden Macro 4.0 Emotet
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/929199
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0dffd50f5e61eaed6623498e1215b1d4d9c16910e996a25231fc9732ea5735c9/
Threat name:
Document-Excel.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2022-01-27 14:36:10 UTC
File Type:
Document
Extracted files:
8
AV detection:
11 of 42 (26.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bx75kd26mhvo2zrdjghbefnr2tm4c2iq5glkeurr7sltf2sxgxeq._file
Result
Malware family:
emotet
Create hunting rule
Score:
  10/10
Tags:
family:emotet botnet:epoch4 banker macro trojan xlm
Link:
https://tria.ge/reports/220127-rx3zjsege5/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in System32 directory
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Emotet
Process spawned unexpected child process
Malware Config
C2 Extraction:
51.15.4.22:443
173.214.173.220:8080
212.237.5.209:443
192.254.71.210:443
216.158.226.206:443
162.243.175.63:443
212.24.98.99:8080
58.227.42.236:80
45.118.115.99:8080
104.251.214.46:8080
185.157.82.209:8080
46.55.222.11:443
188.40.137.206:8080
81.0.236.90:443
103.75.201.2:443
129.232.188.93:443
195.154.133.20:443
159.8.59.82:8080
79.172.212.216:8080
138.185.72.26:8080
200.17.134.35:7080
185.157.82.211:8080
209.59.138.75:7080
178.63.25.185:443
45.176.232.124:443
45.118.135.203:7080
164.68.99.3:8080
203.114.109.124:443
212.237.17.99:8080
50.116.54.215:443
131.100.24.231:80
212.237.56.116:7080
45.142.114.231:8080
162.214.50.39:7080
51.38.71.0:443
104.168.155.129:8080
107.182.225.142:8080
217.182.143.207:443
158.69.222.101:443
176.104.106.96:8080
207.38.84.195:8080
41.76.108.46:8080
110.232.117.186:8080
178.79.147.66:8080
173.212.193.249:8080
Dropper Extraction:
http://91.240.118.168/zzx/ccv/fe.html
http://91.240.118.168/zzx/ccv/fe.png
Malware family:
Emotet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/0dffd50f5e61/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0dffd50f5e61eaed6623498e1215b1d4d9c16910e996a25231fc9732ea5735c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Excel_Hidden_Macro_Sheet
Create hunting rule
Rule name:INDICATOR_OLE_Excel4Macros_DL2
Create hunting rule
Author:ditekSHen
Description:Detects OLE Excel 4 Macros documents acting as downloaders
Rule name:Qbot
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule to Detect Qbot
Rule name:SUSP_Excel4Macro_AutoOpen
Create hunting rule
Author:John Lambert @JohnLaTwC
Description:Detects Excel4 macro use with auto open / close

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Heodo

Excel file xls 0dffd50f5e61eaed6623498e1215b1d4d9c16910e996a25231fc9732ea5735c9

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/224370/

Comments