MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12d47f62ed1f5d60193a3a3099873286365c15dc6bf9df17aa250e1f7660c36c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 17


Maldoc score: 21


Intelligence 17 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12d47f62ed1f5d60193a3a3099873286365c15dc6bf9df17aa250e1f7660c36c
SHA3-384 hash: ee6bfefece5f35eefff5a4ac23f1a5567d79b79f416a32750aa0efe1cc3693783fc2db09e5ffa9ff9b59b7140c555165
SHA1 hash: 8b322500fa186ca8f6e2fe0494214ad2b527d8d0
MD5 hash: 5b539c1cf933b4b4158552ce25f708e1
humanhash: berlin-march-wolfram-coffee
File name:Payment Confirmation..docm
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:16'050 bytes
First seen:2024-12-09 15:34:24 UTC
Last seen:Never
File type:Word file docm
MIME type:application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep 384:/imtLGAcgqN+v6+iAn0i13LHHOXv+iT3eZaakbM:/LL9cgqa3rv13jOXGiT3i
TLSH T1F972BF7CC007B854C6F30A3C959616F4F54C181AD6A6B1AB3709A6CDEDA8963036E6CE
TrID 53.6% (.DOCM) Word Microsoft Office Open XML Format document (with Macro) (52000/1/9)
24.2% (.DOCX) Word Microsoft Office Open XML Format document (23500/1/4)
18.0% (.ZIP) Open Packaging Conventions container (17500/1/4)
4.1% (.ZIP) ZIP compressed archive (4000/1)
Magika docx
Reporter abuse_ch
Tags:docm SnakeKeylogger

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 21
OLE dump

MalwareBazaar was able to identify 6 sections in this file using oledump:

Section IDSection sizeSection name
A1374 bytesPROJECT
A241 bytesPROJECTwm
A33184 bytesVBA/ThisDocument
A42533 bytesVBA/_VBA_PROJECT
A5521 bytesVBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecAutoOpenRuns when the Word document is opened
IOCpSRrNpLv0bS37RA.exeExecutable file name
SuspiciousOpenMay open a file
SuspiciouswriteMay write to a file (if combined with Open)
SuspiciousbinaryMay read or write a binary file (if combined with Open)
SuspiciousADODB.StreamMay create a text file
SuspiciousSaveToFileMay create a text file
SuspiciousShellMay run an executable file or a system command
SuspiciousvbNormalFocusMay run an executable file or a system command
SuspiciousCreateMay execute file or a system command through WMI
SuspiciousCreateObjectMay create an OLE object
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
3'694
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Payment Confirmation..docm
Verdict:
Malicious activity
Analysis date:
2024-12-09 15:58:31 UTC
Tags:
macros macros-on-open opendir loader
Link:
https://app.any.run/tasks/2a328d47-7ac9-4862-8602-37a48201574d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
TwinWave.EvilDoc.PDATARootDown.20220203.UNOFFICIAL
Create hunting rule

Doc.Dropper.Agent-6412232-1
Create hunting rule

TwinWave.EvilDoc.PDATARootDown.20210830.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DLAndDetonateBlameMe.20220110.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67570e2848182d1685571919
Tags:
office macro micro
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
DNS request
Sending an HTTP GET request
Creating a file
Launching a process
Creating a process with a hidden window
Connection attempt by exploiting the app vulnerability
Unauthorized injection to a recently created process
Creating a process from a recently created file
Result
Verdict:
Malicious
File Type:
Word File with Macro
Link:
https://app.docguard.net/12d47f62ed1f5d60193a3a3099873286365c15dc6bf9df17aa250e1f7660c36c/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
dropper macros macros-on-open
Link:
https://www.filescan.io/uploads/67570e28aae3e2f80947db80/reports/a61c0b26-1ece-4077-9480-3cc5a74241ab/overview
Verdict:
Malicious
Labled as:
Valyria
Link:
https://www.hybrid-analysis.com/sample/12d47f62ed1f5d60193a3a3099873286365c15dc6bf9df17aa250e1f7660c36c
Gathering data
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/12d47f62ed1f5d60193a3a3099873286365c15dc6bf9df17aa250e1f7660c36c
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Macro with File System Write
Detected macro logic that can write data to the file system.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1571715
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Document contains an embedded VBA with functions possibly related to HTTP operations
Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Document exploit detected (process start blacklist hit)
Found malware configuration
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office process drops PE file
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Scheduled temp file as task from temp location
Sigma detected: Suspicious Microsoft Office Child Process
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1571715 Sample: Payment Confirmation..docm Startdate: 09/12/2024 Architecture: WINDOWS Score: 100 60 Found malware configuration 2->60 62 Malicious sample detected (through community Yara rule) 2->62 64 Antivirus detection for URL or domain 2->64 66 21 other signatures 2->66 7 WINWORD.EXE 343 18 2->7         started        12 taskeng.exe 1 2->12         started        process3 dnsIp4 58 52575815-38-20200406120634.webstarterz.com 163.44.198.57, 49161, 80 GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG Singapore 7->58 34 C:\ProgramData\pSRrNpLv0bS37RA.exe, PE32 7->34 dropped 36 C:\Users\...\~WRD0000.tmp:Zone.Identifier, ASCII 7->36 dropped 38 C:\Users\user\Desktop\~WRD0000.tmp, Microsoft 7->38 dropped 40 C:\...\Payment Confirmation..docm (copy), Microsoft 7->40 dropped 76 Document exploit detected (creates forbidden files) 7->76 14 pSRrNpLv0bS37RA.exe 1 10 7->14         started        18 Vzvbbx.exe 4 12->18         started        file5 signatures6 process7 file8 42 C:\Users\user\AppData\Roaming\Vzvbbx.exe, PE32 14->42 dropped 44 C:\Users\user\AppData\Local\...\tmpD95F.tmp, XML 14->44 dropped 78 Multi AV Scanner detection for dropped file 14->78 80 Machine Learning detection for dropped file 14->80 82 Uses schtasks.exe or at.exe to add and modify task schedules 14->82 84 Injects a PE file into a foreign processes 14->84 20 vbc.exe 12 2 14->20         started        24 powershell.exe 4 14->24         started        26 schtasks.exe 14->26         started        86 Writes to foreign memory regions 18->86 88 Allocates memory in foreign processes 18->88 90 Adds a directory exclusion to Windows Defender 18->90 28 vbc.exe 18->28         started        30 powershell.exe 18->30         started        32 schtasks.exe 18->32         started        signatures9 process10 dnsIp11 46 checkip.dyndns.com 193.122.6.168, 49162, 80 ORACLE-BMC-31898US United States 20->46 48 reallyfreegeoip.org 188.114.96.6, 443, 49163, 49164 CLOUDFLARENETUS European Union 20->48 50 checkip.dyndns.org 20->50 68 Installs new ROOT certificates 20->68 70 Tries to steal Mail credentials (via file / registry access) 20->70 52 reallyfreegeoip.org 28->52 54 158.101.44.242, 49165, 80 ORACLE-BMC-31898US United States 28->54 56 2 other IPs or domains 28->56 72 Tries to harvest and steal browser information (history, passwords, etc) 28->72 signatures12 74 Tries to detect the country of the analysis system (by using the IP) 52->74
Score:
100%
Verdict:
Malware
File Type:
OFFICE
Link:
https://malprob.io/report/12d47f62ed1f5d60193a3a3099873286365c15dc6bf9df17aa250e1f7660c36c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12d47f62ed1f5d60193a3a3099873286365c15dc6bf9df17aa250e1f7660c36c/
Threat name:
Document-Word.Trojan.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2024-12-09 08:04:01 UTC
File Type:
Document
Extracted files:
20
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=clkh6yxnd5owagj2hiyjtbzsqy3fyfo4np456f5keuhb65taynwa._file
Verdict:
malicious
Label(s):
snakekeylogger
Create hunting rule
unknown_loader_037
Create hunting rule
Similar samples:
error
SnakeKeylogger
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection discovery execution keylogger macro stealer
Link:
https://tria.ge/reports/241209-s1b6nsxleq/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Scheduled Task/Job: Scheduled Task
Script User-Agent
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Uses the VBS compiler for execution
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Snake Keylogger
Snake Keylogger payload
Snakekeylogger family
Verdict:
Malicious
Tags:
Doc.Downloader.Valyria-10031769-0
YARA:
n/a
Link:
https://app.threat.zone/submission/224d9180-de16-4563-bfd6-aeccaa2ce5d2
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/12d47f62ed1f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/12d47f62ed1f5d60193a3a3099873286365c15dc6bf9df17aa250e1f7660c36c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:RansomPyShield_Antiransomware
Create hunting rule
Author:XiAnzheng
Description:Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)
Rule name:SUSP_VBA_FileSystem_Access
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious VBA that writes to disk and is activated on document open
Reference:Internal Research
Rule name:SUSP_VBA_FileSystem_Access_RID30A9
Create hunting rule
Author:Florian Roth
Description:Detects suspicious VBA that writes to disk and is activated on document open
Reference:Internal Research
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments