MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2b3ee191f72d0133734ef46a4beb825ecf214eabdeaf7bd5fdcf088e40a14afb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 9
| SHA256 hash: | 2b3ee191f72d0133734ef46a4beb825ecf214eabdeaf7bd5fdcf088e40a14afb |
|---|---|
| SHA3-384 hash: | c847a8c6553349ead47256ae8c3289cedce575eda9b8ae60647944b2e93cec42dafdf1ce70eb9709c552f13be6b6d7da |
| SHA1 hash: | 9dd044c298f79603ed0eed835b0ba8e23aa1ce4f |
| MD5 hash: | 97b4975d09e0923730a9dcf94e9c6705 |
| humanhash: | mississippi-three-steak-two |
| File name: | 19.pdf.ppam |
| Download: | download sample |
| File size: | 42'625 bytes |
| First seen: | 2022-02-24 08:01:35 UTC |
| Last seen: | Never |
| File type: |  ppam |
| MIME type: | application/vnd.openxmlformats-officedocument.presentationml.presentation |
| ssdeep | 768:b+MRD4S0JS00SneSnjS0yS03S0IMS0bS02SxD/PoVK5Z1lDVn3QFTy1xqwVwxydK:b+2p75eAGAG1/K8NytsRAub |
| TLSH | T17313BF18C041250AC2B36A3EC83898E51D97DC17A116558FE4EA7A4B1B64DDB3B4EFCD |
| Reporter |  abuse_ch |
| Tags: | aggah hagga ppam |
Intelligence
File Origin
# of uploads :
1
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malicious
File Type:
Legacy PowerPoint File with Macro
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-vm macros macros-on-open mshta virus
Label:
Malicious
Suspicious Score:
9.9/10
Score Malicious:
1%
Score Benign:
0%
Result
Verdict:
MALICIOUS
Link:
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Script-Macro.Trojan.Heuristic
Status:
Malicious
First seen:
2022-02-24 08:02:11 UTC
File Type:
Document
Extracted files:
43
AV detection:
15 of 27 (55.56%)
Threat level:
2/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
ppam 2b3ee191f72d0133734ef46a4beb825ecf214eabdeaf7bd5fdcf088e40a14afb
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.