MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1dce0c1c728a8993702d7898a3711f8a771ae65c732f07572b70118e989b9682. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

216

Origin country :

n/a

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

TwinWave.EvilDoc.DataopWereSendingYouBack.220331.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.XLSBLOLBINHammerToFall.20210414.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

OOXML Excel File with Excel4Macro

Link:

https://app.docguard.net/1dce0c1c728a8993702d7898a3711f8a771ae65c732f07572b70118e989b9682/results/dashboard

Payload URLs

URL

File name

http://uri.etsi.org/01903#SignedProperties

sig1.xml

Document image

Image:

Download PNG

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/62581f0effe27d5119ce7997/reports/9d697309-6ec0-4335-99d1-71d0e3f6a329/overview

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/1dce0c1c728a8993702d7898a3711f8a771ae65c732f07572b70118e989b9682

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1dce0c1c728a8993702d7898a3711f8a771ae65c732f07572b70118e989b9682/

ReversingLabs TitaniumCloud Document-Office.Trojan.Heuristic

Threat name:

Document-Office.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2022-04-14 13:18:10 UTC

File Type:

Binary (Archive)

Extracted files:

97

AV detection:

4 of 42 (9.52%)

Threat level:

  2/5

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/220414-qjx1psdda8/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Process spawned unexpected child process

Malware Config

Dropper Extraction:

http://rommify.net/Mm2cPksfn0/Dmnh.png
http://c-logistica.com/qS4NKRYI/Dmnh.png
http://mhdti.com/e03BksINQKc/Dmnh.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.74

Link:

https://yomi.yoroi.company/submissions/1dce0c1c728a8993702d7898a3711f8a771ae65c732f07572b70118e989b9682