MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 144c4169fba54d84b6f8b73bae6d28473b7e7cd09b3d032343cd79e01878549b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Hancitor

Vendor detections: 7

Maldoc score: 11

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	144c4169fba54d84b6f8b73bae6d28473b7e7cd09b3d032343cd79e01878549b
SHA3-384 hash:	bcbe4c3b34c8630b9ae08886625fed9a54f445358d7d34c9ea5b628ad7c3db7b24bb9e794102584b237f38e9334d1842
SHA1 hash:	d9d9bb750689fa95e6d0f17586ed7bdd1b965a85
MD5 hash:	de9538b9867e559105756da43f5c2ad2
humanhash:	uniform-jupiter-kansas-red
File name:	1210_80556334.doc
Download:	download sample
Signature	Hancitor Create hunting rule
File size:	391'680 bytes
First seen:	2020-12-10 15:57:19 UTC
Last seen:	Never
File type:	doc
MIME type:	application/msword
ssdeep	6144:qHOE0gaCGePXRyr+tEebyCE4899u7vyMe2cz:quE0gXPByytZyTWyyS
TLSH	35849D03B298C837E22B87307E67C6B5176A7C144F68A5DF37853B5E5F72291AA20347
Reporter	malware_traffic
Tags:	doc Hancitor macros

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 11

Application name is Microsoft Office Word

Office document is in OLE format

Office document contains VBA Macros

OLE dump

MalwareBazaar was able to identify 18 sections in this file using oledump:

Section ID	Section size	Section name
1	114 bytes	CompObj
2	280 bytes	DocumentSummaryInformation
3	428 bytes	SummaryInformation
4	9531 bytes	1Table
5	133939 bytes	Data
6	616 bytes	Macros/PROJECT
7	146 bytes	Macros/PROJECTwm
8	2997 bytes	Macros/VBA/Module1
9	3165 bytes	Macros/VBA/Module10
10	1805 bytes	Macros/VBA/Module11
11	1247 bytes	Macros/VBA/Module12
12	3057 bytes	Macros/VBA/ThisDocument
13	4556 bytes	Macros/VBA/_VBA_PROJECT
14	1011 bytes	Macros/VBA/dir
15	76 bytes	ObjectPool/_1669079229/CompObj
16	215861 bytes	ObjectPool/_1669079229/Ole10Native
17	6 bytes	ObjectPool/_1669079229/ObjInfo
18	4096 bytes	WordDocument

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	Document_Open	Runs when the Word or Publisher document is opened
IOC	W0rd.dll	Executable file name
Suspicious	Shell	May run an executable file or a system command
Suspicious	ShellExecute	May run an executable file or a system command
Suspicious	Shell32	May run an executable file or a system command
Suspicious	CreateObject	May create an OLE object
Suspicious	Base64 Strings	Base64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin

# of uploads :

# of downloads :

619

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Badmacro.Doc.Em32.UNOFFICIAL

MiscreantPunch.EXEInsideOfDoc.2.UNOFFICIAL

MiscreantPunch.EXEInsideOfDoc.1.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Moving a file to the %AppData% subdirectory

DNS request

Sending an HTTP GET request

Sending an HTTP POST request

Launching a process

Creating a file

Reading critical registry keys

Launching a service

Sending a TCP request to an infection source

Stealing user critical data

Launching a process by exploiting the app vulnerability

Unauthorized injection to a system process

Result

Verdict:

Suspicious

File Type:

Legacy Word File with Macro

Link:

https://app.docguard.net/144c4169fba54d84b6f8b73bae6d28473b7e7cd09b3d032343cd79e01878549b/results/dashboard

Document image

Image:

Download PNG

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

Document With Few Pages

Document contains between one and three pages of content. Most malicious documents are sparse in page count.

Macro Execution Coercion

Detected a document that appears to social engineer the user into activating embedded logic.

Macro Contains Suspicious String

Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/144c4169fba54d84b6f8b73bae6d28473b7e7cd09b3d032343cd79e01878549b/

Threat name:

Script-WScript.Trojan.Heuristic

Status:

Malicious

First seen:

2020-12-10 15:58:05 UTC

AV detection:

5 of 48 (10.42%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=crgec2p3uvgyjnxyw45243jii45x47gqtm6qgi2dzv46agdyksnq._file

Result

Malware family:

n/a

Score:

10/10

Tags:

macro

Link:

https://tria.ge/reports/201210-wne8cwdce2/

Behaviour

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Office loads VBA resources, possible macro or embedded object present

Drops file in Windows directory

Process spawned unexpected child process

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Virus

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/144c4169fba54d84b6f8b73bae6d28473b7e7cd09b3d032343cd79e01878549b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	hancitor Create hunting rule
Author:	J from THL <j@techhelplist.com>
Description:	Memory string yara for Hancitor

Rule name:	INDICATOR_OLE_ObjectPool_Embedded_Files Create hunting rule
Author:	ditekSHen
Description:	Detects OLE documents with ObjectPool OLE storage and embed suspicous excutable files

Rule name:	win_hancitor_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample