🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1643121b7717fa43c8ab9b26fcdd8cb718eea57bce6ddfbac4967d5fef5a3807. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1643121b7717fa43c8ab9b26fcdd8cb718eea57bce6ddfbac4967d5fef5a3807
SHA3-384 hash: a54edd2b8fe4c7518346f7b31ac70170274ceb8e928046c58e637e278583dd12b5c233ce73d9d4262596fd0f48b5c41a
SHA1 hash: 8ac450d4c377c4096934d490275a7b5e9e29bd32
MD5 hash: d1a8d0e4cb934d39963c8e820a2c3a11
humanhash: maryland-shade-video-wyoming
File name:1643121b7717fa43c8ab9b26fcdd8cb718eea57bce6ddfbac4967d5fef5a3807
Download: download sample
Signature IcedID
Create hunting rule
File size:2'211'022 bytes
First seen:2022-10-08 14:35:16 UTC
Last seen:Never
File type: zip
MIME type:application/octet-stream
ssdeep 49152:CPXFgurgl5R/4NurkXDYqM/JDK6M3fKgDalz:Bk0DHkX8hDK9igDY
TLSH T1D6A52306E6410E7FFD1244B13CBE95C592433E77A16AFAC1284B7D8B2283F590EB9B51
TrID 53.0% (.DOCM) Word Microsoft Office Open XML Format document (with Macro) (52000/1/9)
23.9% (.DOCX) Word Microsoft Office Open XML Format document (23500/1/4)
17.8% (.ZIP) Open Packaging Conventions container (17500/1/4)
4.0% (.ZIP) ZIP compressed archive (4000/1)
1.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter vxunderground
Tags:IcedID zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
333
Origin country :
n/a
File Archive Information

This file archive contains 17 file(s), sorted by their relevance:

File name:core.xml
File size:747 bytes
SHA256 hash: 15e8a30f890acc32c6b162f65d3ab6182fc6c24e115eb4e5b0b397c88c5f8288
MD5 hash: 2b9f562d4f835bb0f2f83df595bdb40d
MIME type:text/xml
Signature IcedID
File name:vbaData.xml
File size:2'679 bytes
SHA256 hash: f9aef554c1f4e0621aff1d5cbe6a3b25fcb12a4a2ba793aff7f8c4086095da21
MD5 hash: ab0277646f8a3f4fb1edc949fa245af0
MIME type:text/xml
Signature IcedID
File name:settings.xml
File size:2'973 bytes
SHA256 hash: df495616694940322aa9ace323613a1d750701d5c59186b8d5fda1f24e9fa414
MD5 hash: 029230894a0d4c6408558a442a8073ed
MIME type:text/xml
Signature IcedID
File name:[Content_Types].xml
File size:1'635 bytes
SHA256 hash: ba71c2f55d4c4e2064bcd2246c85652dfda4f8f4a57af886f74298c5bbb09e0f
MD5 hash: 912a9c32c0005c53064b623028fd3990
MIME type:text/xml
Signature IcedID
File name:document.xml
File size:4'900 bytes
SHA256 hash: 7a991a1c8113fe6f2aca067c2b005f203fd769f27cb3d04b00fb5919e08fe61e
MD5 hash: 73330117688f623d2271d9ea12750e64
MIME type:text/xml
Signature IcedID
File name:itemProps1.xml
File size:299 bytes
SHA256 hash: d3789a0c63d2d6644ed5e453bf77d70bdcf9efee40a19acffcda1b45f63d8a45
MD5 hash: e561cfd96de19134c22fba1e8efdd497
MIME type:text/xml
Signature IcedID
File name:webSettings.xml
File size:894 bytes
SHA256 hash: a935be2dde349160ee390cc5b6a06aa057cfd44feac230f6eff440889f53902f
MD5 hash: 59ba25a75dfbabcf18d26f4948317c0c
MIME type:text/xml
Signature IcedID
File name:app.xml
File size:709 bytes
SHA256 hash: 9af4afad5166af14c6ca2f0d3067fe350ebcca933957b761d6739278249a769f
MD5 hash: d50a30914e1adffd038b1aa0857e1946
MIME type:text/xml
Signature IcedID
File name:item1.xml
File size:1'440'842 bytes
SHA256 hash: f433b57cbce6bee513d72038fa0ad1baf1549bd5668670e177d9cd03862c8b6a
MD5 hash: c6152600fabe695c175826119b68c6a5
MIME type:text/plain
Signature IcedID
File name:theme1.xml
File size:8'393 bytes
SHA256 hash: 70a70d84494772c1855ec6c2f9a16e0fc6cc41bdb0ce3743563ed943b63e07b8
MD5 hash: fc5dd7a11f76159e8ac4ecd5e3e1b518
MIME type:text/xml
Signature IcedID
File name:document.xml.rels
File size:1'213 bytes
SHA256 hash: 684882883e626d3b921568876a0811019160e6165464f820ff77f21f39afb1de
MD5 hash: 1b02e1919de50f7a1db14d33ace5c444
MIME type:text/xml
Signature IcedID
File name:item1.xml.rels
File size:296 bytes
SHA256 hash: 80482f86e196171d66001e0e74d1900408a3aaf2463e54005d251b5f2db9a0b0
MD5 hash: 7e5e23715ab49ce56f9130d4c6534a30
MIME type:text/xml
Signature IcedID
File name:fontTable.xml
File size:1'658 bytes
SHA256 hash: 4a268018e1f1057231c337b7f15d39664565ea7af8275dd4f21686c71e578a1f
MD5 hash: 48eba73ff4dc704a599962ab19ad7c2e
MIME type:text/xml
Signature IcedID
File name:image1.png
File size:1'881'584 bytes
SHA256 hash: 920ba3b165444f174703085c409b1889b6df65e07ce6a1a4f58884e9850b2c76
MD5 hash: edf343fd25d987db98315442b0188d24
MIME type:image/png
Signature IcedID
File name:styles.xml
File size:29'455 bytes
SHA256 hash: e12c87e9dd0535ec09e40b7dc5ea70f32f2008b9a9eb9d289f8bb345286eaa1f
MD5 hash: 9f22ea258bb4bbb3a3b5361e87a49a8c
MIME type:text/xml
Signature IcedID
File name:vbaProject.bin.rels
File size:277 bytes
SHA256 hash: c97833e6456aa2bfe9be614f9c3ae41a8ef764b1cc3af92c6a6f273c62309122
MD5 hash: dd79e6440b0515bfcf771c2c5286a2c8
MIME type:text/xml
Signature IcedID
File name:vbaProject.bin
File size:7'168 bytes
SHA256 hash: 991211add012234067a8de9d0160a2be799bc5fc719b5ea5aa0f3982c432fc77
MD5 hash: 41e80b5adb93dc3cea29ce2e8e00f179
MIME type:application/CDFV2
Signature IcedID
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.VBS.Obfus-187.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.ICEDPicturesOfU.WORD.220919.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.ICEDPicturesOfU.ZIP.220919.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.PKillDOCXEmbeddedHexyEXEAxelF.20210920.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Legacy Office File
Link:
https://app.docguard.net/1643121b7717fa43c8ab9b26fcdd8cb718eea57bce6ddfbac4967d5fef5a3807/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
macros macros-on-open obfuscated packed phishing rundll32
Link:
https://www.filescan.io/uploads/63418ad5d089a0c15dd5e041/reports/ba9a0b90-1619-4e16-a1a5-191368b3feda/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1643121b7717fa43c8ab9b26fcdd8cb718eea57bce6ddfbac4967d5fef5a3807/
Threat name:
Document-Excel.Trojan.Sadoca
Create hunting rule
Status:
Malicious
First seen:
2022-10-05 09:46:51 UTC
File Type:
Document
Extracted files:
26
AV detection:
9 of 25 (36.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=czbreg3xc75ehsfltmtpzxmmw4mo5jl3zzw57owesz6v7322hadq._file
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid campaign:3281798692 banker loader macro trojan
Link:
https://tria.ge/reports/221008-ryj8tsehc6/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Drops file in Windows directory
Loads dropped DLL
Blocklisted process makes network request
IcedID, BokBot
Process spawned unexpected child process
Malware Config
C2 Extraction:
kolinandod.com
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1643121b7717fa43c8ab9b26fcdd8cb718eea57bce6ddfbac4967d5fef5a3807

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments