MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13be05beeaa3d8484fe8c4e244a4a548ee4da7da656b546c44f037f5b7a7220e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	13be05beeaa3d8484fe8c4e244a4a548ee4da7da656b546c44f037f5b7a7220e
SHA3-384 hash:	db55e0963a6d6c734c81176e043c1a8d2a1a95be53dc45f07ac23ea114169736c5973fa9fcb4b1e31589f24a2fc8f110
SHA1 hash:	b21c87bcb5163abea46beab68bb375427f98d26b
MD5 hash:	2dbee66a11906795d31e1ced9932ba2e
humanhash:	south-mirror-uranus-florida
File name:	Answer_key_exercises_Unit_1_ _2_grammar_test.docx
Download:	download sample
File size:	642'326 bytes
First seen:	2026-10-21 21:23:06 UTC
Last seen:	Never
File type:	doc
MIME type:	application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep	12288:sG+hBLvdU07SERP/NuUHYGxWMZUdTGDtdUg8wnRVh+8lUZBZ456f3/CaQX:sGEBL1VSEB1uU4GxWMZUQZdUg8KM8lU8
TLSH	T18AD42347F09AC572F127503152A3CCA66B3B0808C4265E6836A5E6396FC3BD78D59BCF
TrID	52.2% (.DOCX) Word Microsoft Office Open XML Format document (23500/1/4) 38.8% (.ZIP) Open Packaging Conventions container (17500/1/4) 8.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	docx
Reporter	TomU
Tags:	doc

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

Embedded Images

MalwareBazaar found the following images embedded in this file:

MD5 hash	dc.creator	# of relations
2878a28ce5a79347e104c3d0493432cb	Jorunn Hakkaart	None
d8c7997f9a7003d07eee9420d0e74904	Jorunn Hakkaart	None
b1a28589d20fe446869ca90691d97c59	Jorunn Hakkaart	None
c15757879478441347f0636449123e19	Jorunn Hakkaart	None
c584871a160dddf7ffe187c48f5631a1	Jorunn Hakkaart	None
07bdd517aabca9acf526261bf409b628	Jorunn Hakkaart	None
08d04985ac87b3a333216418096a61d1	Jorunn Hakkaart	None
30e294c9f0faa78a77449b562d0abd22	Jorunn Hakkaart	None
ba485bd030217c83a8388622b6cb2c75	Jorunn Hakkaart	None
da4b7576c4a0ca58797964b23bcf68c4	Jorunn Hakkaart	None
10488420a4b02bb5f5752a05d591ae6d	Jorunn Hakkaart	None
8e828b02ea1e6fd967d8af79011c8f09	Jorunn Hakkaart	None
6db8678f3bb327d826bc3e050efb0aab	Jorunn Hakkaart	None
ee780d814aea049d3e0cb3380c973ea0	Jorunn Hakkaart	None
4c2c5dc4f9e9c8aceeaf47106d6e2836	Jorunn Hakkaart	None

Intelligence

File Origin

# of uploads :

# of downloads :

197

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

MSO

Details

Link:

https://research.acce.ciphertechsolutions.com/results/4f6f8822-1797-4327-a091-23a45d7adf51/

Malware family:

n/a

ID:

File name:

doc

Verdict:

No threats detected

Analysis date:

2026-10-21 21:35:26 UTC

Tags:

external-template

Link:

https://app.any.run/tasks/95b33ed4-f0cb-408b-895d-0d993c9d9652

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Legit

File type:

application/msword

Has a screenshot:

False

Contains macros:

False

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad92d575a22ac805bd924a4

Tags:

n/a

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Creating synchronization primitives

Sending a custom TCP request

Result

Verdict:

Clean

File Type:

OOXML Word File

Link:

https://app.docguard.net/13be05beeaa3d8484fe8c4e244a4a548ee4da7da656b546c44f037f5b7a7220e/results/dashboard

Document image

Image:

Download PNG

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/6ad92d476eba3e9fc3f2ec55/reports/24716454-3488-45b6-90b1-dfb3e7b5bcde/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/13be05beeaa3d8484fe8c4e244a4a548ee4da7da656b546c44f037f5b7a7220e

Label:

Benign

Suspicious Score:

/10

Score Malicious:

Score Benign:

Link:

https://www.malware.ai/gui/files/?id=34df23d4-8de1-4ce1-a807-361de78a0491

Verdict:

Unknown

File Type:

docx

Link:

https://opentip.kaspersky.com/13be05beeaa3d8484fe8c4e244a4a548ee4da7da656b546c44f037f5b7a7220e/results?tab=lookup

Score:

Verdict:

Benign

File Type:

OFFICE

Link:

https://malprob.io/report/13be05beeaa3d8484fe8c4e244a4a548ee4da7da656b546c44f037f5b7a7220e

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Office Document

Link:

https://app.malva.re/file/2dbee66a11906795d31e1ced9932ba2e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/13be05beeaa3d8484fe8c4e244a4a548ee4da7da656b546c44f037f5b7a7220e/

Threat name:

Document.Trojan.Heuristic

Status:

Malicious

First seen:

2026-10-21 21:23:27 UTC

File Type:

Document

Extracted files:

AV detection:

3 of 38 (7.89%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=co7alpxkupmeqt7iytrejjffjdxe3j62mvvvi3ce6a37ln5heiha._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/261021-z8mqpsxy8m/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/13be05beeaa3d8484fe8c4e244a4a548ee4da7da656b546c44f037f5b7a7220e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	JP_Lure_Content_Hunt Create hunting rule
Author:	sumeshi
Description:	Hunts for files containing Japanese kana text or common Japanese lure terminology

Rule name:	MULTI_Malware_Unknown_ForgeAuto_4f67e0b3_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

doc 13be05beeaa3d8484fe8c4e244a4a548ee4da7da656b546c44f037f5b7a7220e

(this sample)

Delivery method

Distributed via e-mail attachment

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample