MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21ab4d43f1127c42afbc0a7547ef4e45efa21b9f897b3b359de7b77d2c2391f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21ab4d43f1127c42afbc0a7547ef4e45efa21b9f897b3b359de7b77d2c2391f8
SHA3-384 hash: 6181fdf9ab207cc412b71b80f3647a2499240a8ba5380582fd3edd304c2d55b332a67fb55ebcad5b1abe4eff643c78d4
SHA1 hash: f47b12144d1495fad3ceda13618282a0afb5b4d8
MD5 hash: f6f57869c10170744bf2c2078cd8760b
humanhash: happy-south-double-summer
File name:21ab4d43f1127c42afbc0a7547ef4e45efa21b9f897b3b359de7b77d2c2391f8.xlsx
Download: download sample
File size:11'124 bytes
First seen:2020-05-24 20:15:32 UTC
Last seen:Never
File type:Excel file xlsx
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep 192:FCpj7WxVc4oatxm0mvECofaS2lH0HqVRMRqIVms+wTZiMCdT:FicVcotxMvEFfaSC0KgRhqUiMQT
TLSH 1D327DC4E582016FD7B520BBED9A335A870477E86072692FD620D1D81DFA0D7BA8D30D
Reporter JoulK
Tags:xlsx

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Malware.XML.Autoload-1.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EQAndMisCasedOleNativeWasTheCaseThatTheyGaveMe.20200215.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Document-Word.Exploit.CVE-2017-11882
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 04:40:30 UTC
File Type:
Document
Extracted files:
14
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-wdrpwla1ve/
Behaviour
Enumerates system info in registry
Launches Equation Editor
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Checks processor information in registry
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments