MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e77dee10295621df8ec4ea11373d83f18743fa40c52a6950b54089f911467bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e77dee10295621df8ec4ea11373d83f18743fa40c52a6950b54089f911467bb
SHA3-384 hash: d00244ce71852f5d7781cdf3b243d43f9f1e5c5189185965eae58ab4d729e24e45fa3279d8294702acfc3b8fc0b20792
SHA1 hash: 5011995c88318389ce8bf956e157dadf79dd792c
MD5 hash: ff5aba648966325499c17beb1d52e0fd
humanhash: pennsylvania-london-nevada-monkey
File name:rev5555.odt
Download: download sample
File size:2'358 bytes
First seen:2026-02-22 18:15:52 UTC
Last seen:Never
File type:
MIME type:application/zip
ssdeep 48:90q9mLBbAIiSKXsulXvvGskoQoOqL4E6W+zwwB4emGKwk:GqkjiStEOs8eL4E6WSHy1wk
TLSH T14941B6315C05C746F372B3B694AA99C2E40E22F1EB1C6B23B0F4E1786DDBDC40A2135A
TrID 50.0% (.) Zip document container (generic) (4008/2)
49.9% (.ZIP) ZIP compressed archive (4000/1)
Magika odt
Reporter juroots
Tags:odt

Intelligence

File Origin
# of uploads :
1
# of downloads :
32
Origin country :
IL IL
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/1ea590d8-2c02-4eb0-8f4a-b43313586038/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=699c05a1c950ab5d9ab0b68e
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/0e77dee10295621df8ec4ea11373d83f18743fa40c52a6950b54089f911467bb
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/0e77dee10295621df8ec4ea11373d83f18743fa40c52a6950b54089f911467bb
Details
Base64 Encoded Powershell Directives
Detected one or more base64 encoded Powershell directives.
Macro Execution Coercion in Document
Detected a document that appears to social engineer the user into activating embedded logic.
Hidden Powershell
Detected a pivot to Powershell that utilizes commonly nefarious attributes such as '-windowstyle hidden'.
Powershell in Macro
Detected a macro that may utilize Powershell. Such pivots are commonly found in malware.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
Score:
2%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/0e77dee10295621df8ec4ea11373d83f18743fa40c52a6950b54089f911467bb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e77dee10295621df8ec4ea11373d83f18743fa40c52a6950b54089f911467bb/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bz355yicsvrb36hmj2qrg46yh4mhip5ebrjknfilkqej7eium65q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/0e77dee10295621df8ec4ea11373d83f18743fa40c52a6950b54089f911467bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CommonBase64ReverseShellStrings
Create hunting rule
Description:Detects common powershell base64 reverse shell strings
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:SUSP_Macro_StarOffice
Create hunting rule
Author:John Lambert @JohnLaTwC
Description:Suspicious macro in StarOffice
Reference:https://twitter.com/JohnLaTwC/status/1093259873993732096
Rule name:SUSP_PS1_JAB_Pattern_Jun22_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

0e77dee10295621df8ec4ea11373d83f18743fa40c52a6950b54089f911467bb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3784033/
  
Delivery method
Distributed via web download

Comments