MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 12eaf951c99536e73590646abe3c82ced0e9c7a0e475ac3138884ba977fa2549. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Dridex
Vendor detections: 8
| SHA256 hash: | 12eaf951c99536e73590646abe3c82ced0e9c7a0e475ac3138884ba977fa2549 |
|---|---|
| SHA3-384 hash: | f14129f03ee14bab044ebce7d368aaf1ac9effa2c664e86eed32c362a6711d53ce8aee11ae8836d934f320703da30f96 |
| SHA1 hash: | be630c93bea7edd5cbe0eeac259747e3452ee05c |
| MD5 hash: | c429449c26cfd371956049a1764e33d5 |
| humanhash: | texas-ink-gee-princess |
| File name: | problems280840.xlsb |
| Download: | download sample |
| Signature | Dridex |
| File size: | 184'986 bytes |
| First seen: | 2021-11-29 17:44:12 UTC |
| Last seen: | 2021-12-06 14:55:14 UTC |
| File type: |  xlsx |
| MIME type: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
| ssdeep | 3072:b1l5oJlmNhY1+w3TOXKHlG7fYK24i2X+UH0VlOZtyyiznPxSn+xCFTfMezGxtnMu:WJlDv3TzsfMMuUUOZtyy0PxSnfFTGFC6 |
| TLSH | T13704129F7095D40ECADB513D621885787A20A513C2FC4528357AE22C1B7FE25CFA9E7C |
| Reporter |  TeamDreier |
| Tags: | Dridex xlsx |
Intelligence
File Origin
# of uploads :
3
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
problems280840.xlsb
Verdict:
No threats detected
Analysis date:
2021-11-29 17:59:23 UTC
Tags:
macros40
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
Has a screenshot:
False
Contains macros:
False
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
DNS request
Creating a window
Сreating synchronization primitives
Result
Verdict:
Malicious
File Type:
OOXML Excel File with Excel4Macro
Document image
Image:
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
evasive mshta stripped
Result
Threat name:
Dridex Downloader
Detection:
malicious
Classification:
troj.expl.evad
Score:
88 / 100
Signature
Contains functionality to create processes via WMI
Creates and opens a fake document (probably a fake document to hide exploiting)
Creates processes via WMI
Document exploit detected (process start blacklist hit)
Multi AV Scanner detection for submitted file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: Suspicious MSHTA Process Patterns
Sigma detected: TA505 Dropper Load Pattern
Yara detected Dridex Downloader
Behaviour
Behavior Graph:
Threat name:
Document-Excel.Trojan.XBAgent
Status:
Malicious
First seen:
2021-11-29 17:45:10 UTC
File Type:
Document
Extracted files:
20
AV detection:
7 of 45 (15.56%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
8/10
Tags:
macro xlm
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.