🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b86f53965e6bf5ae33658293d3977894c8f31d7a86df9c24a677e020af0a3a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 16


Intelligence 16 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b86f53965e6bf5ae33658293d3977894c8f31d7a86df9c24a677e020af0a3a3
SHA3-384 hash: 212b9ce6e44bc9273a168e2907db79272f04606fd34bcffcf38d4c2a73ab8bcc956d728c9873a93a8335f1b588a4f09c
SHA1 hash: 7cd5251d59d50dd5e35e9d5019446bff2b6d9712
MD5 hash: 6b8e049bf1c03e57e8dcb3817fc3eb5d
humanhash: april-hot-tennessee-papa
File name:6b8e049bf1c03e57e8dcb3817fc3eb5d.docm
Download: download sample
File size:55'294 bytes
First seen:2026-09-24 11:23:13 UTC
Last seen:Never
File type:Word file docm
MIME type:application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep 1536:Y27U+SCuwrgwSQcn4/z3/m77imLkICqqrv:YT+v17cn4C7jkIfqv
TLSH T1D143F2BBD406B4B1F57BB5FDC90E58F4F6144A82951AF80A667FF2D146208AB03178CE
TrID 46.5% (.TMDX/TMVX) SoftMaker TextMaker text Document (84519/2/13)
28.6% (.DOCM) Word Microsoft Office Open XML Format document (with Macro) (52000/1/9)
12.9% (.DOCX) Word Microsoft Office Open XML Format document (23500/1/4)
9.6% (.ZIP) Open Packaging Conventions container (17500/1/4)
2.2% (.ZIP) ZIP compressed archive (4000/1)
Magika docx
Reporter smica83
Tags:docm UKR

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE dump

MalwareBazaar was able to identify 11 sections in this file using oledump:

Section IDSection sizeSection name
A1421 bytesPROJECT
A265 bytesPROJECTwm
A326986 bytesVBA/Module1
A41280 bytesVBA/ThisDocument
A54537 bytesVBA/_VBA_PROJECT
A64127 bytesVBA/__SRP_0
A7498 bytesVBA/__SRP_1
A87415 bytesVBA/__SRP_2
A91208 bytesVBA/__SRP_3
A10572 bytesVBA/dir

Intelligence

File Origin
# of uploads :
1
# of downloads :
205
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
MSO
Details
Link:
https://research.acce.ciphertechsolutions.com/results/702c1328-cb36-4e73-a165-6beae9ea95f2/
Malware family:
n/a
ID:
1
File name:
docm
Verdict:
No threats detected
Analysis date:
2026-09-24 12:50:06 UTC
Tags:
generated-doc macros macros-on-open
Link:
https://app.any.run/tasks/8ffacbc7-6020-40db-b93b-890843f34306

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/octet-stream
Has a screenshot:
False
Contains macros:
False
Detection(s):
MiscreantPunch.EvilMacro.AODBWSRBMS.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DLAndDetonateBlameMe.20220110.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.PolicyKillShimmyShimmYa.20220208.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.ShimmyShimmyYa.062022.UNOFFICIAL
Create hunting rule

YARA.docx_macro.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6acdddb8853d431abd4dc544
Tags:
autorun office macro sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a window
Сreating synchronization primitives
Launching a service
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process with a hidden window
Running batch commands
Creating a file in the %AppData% subdirectories
Launching a process
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Connection attempt by exploiting the app vulnerability
Sending a custom TCP request by exploiting the app vulnerability
Launching a process by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
Word File with Macro
Link:
https://app.docguard.net/2b86f53965e6bf5ae33658293d3977894c8f31d7a86df9c24a677e020af0a3a3/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
dropper evasive language-uk lolbin macros macros-on-open obfuscated wscript
Link:
https://www.filescan.io/uploads/6ab5085cdd98d1c84242dde3/reports/beb01a49-6a29-4b38-a48e-b87dac6807dc/overview
Verdict:
Malicious
Labled as:
Msoffice/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/2b86f53965e6bf5ae33658293d3977894c8f31d7a86df9c24a677e020af0a3a3
Label:
Malicious
Suspicious Score:
10/10
Score Malicious:
1%
Score Benign:
0%
Link:
https://www.malware.ai/gui/files/?id=6dff10eb-b0ff-44bb-834c-d579d167b0c7
Verdict:
Malicious
File Type:
docm
First seen:
2026-09-16T10:38:00Z UTC
Last seen:
2026-09-24T10:40:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/2b86f53965e6bf5ae33658293d3977894c8f31d7a86df9c24a677e020af0a3a3/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1977550
Signature
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Document contains an embedded VBA with functions possibly related to HTTP operations
Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)
Document exploit detected (creates forbidden files)
Document exploit detected (process start blacklist hit)
Drops VBS files to the startup folder
Multi AV Scanner detection for submitted file
Office process queries suspicious COM object (likely to drop second stage)
Sigma detected: Drops script at startup location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Register Wscript In Run Key
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: Suspicious Ping/Del Command Combination
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Uses WMIC command to query system information (often done to detect virtual machines)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Windows Shell Script Host drops VBS files
WScript reads language and country specific registry keys (likely country aware script)
Yara detected Generic JS Downloader
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1977550 Sample: i7GL6uY1ky.docm Startdate: 24/09/2026 Architecture: WINDOWS Score: 100 101 api.telegram.org 2->101 103 us1.roaming1.live.com.akadns.net 2->103 105 8 other IPs or domains 2->105 121 Sigma detected: Register Wscript In Run Key 2->121 123 Suricata IDS alerts for network traffic 2->123 125 Multi AV Scanner detection for submitted file 2->125 129 18 other signatures 2->129 10 WINWORD.EXE 150 112 2->10         started        15 wscript.exe 2->15         started        17 wscript.exe 2->17         started        19 wscript.exe 2->19         started        signatures3 127 Uses the Telegram API (likely for C&C communication) 101->127 process4 dnsIp5 109 52.110.2.138, 443, 49733 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 10->109 111 52.110.2.157, 443, 49735 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 10->111 113 raw.githubusercontent.com 185.199.110.133, 443, 49700 FASTLY-FastlyIncUS United States 10->113 95 C:\Users\user\AppData\...\Microsoft Excel.dll, ASCII 10->95 dropped 149 Document exploit detected (creates forbidden files) 10->149 151 Office process queries suspicious COM object (likely to drop second stage) 10->151 21 wscript.exe 3 10->21         started        153 System process connects to network (likely due to code injection or exploit) 15->153 155 Windows Scripting host queries suspicious COM object (likely to drop second stage) 15->155 157 WScript reads language and country specific registry keys (likely country aware script) 15->157 25 cmd.exe 15->25         started        27 cmd.exe 15->27         started        29 cmd.exe 15->29         started        37 2 other processes 15->37 115 104.26.13.205, 443, 49723, 49726 CLOUDFLARENET-CloudflareIncUS Canada 17->115 159 Uses WMIC command to query system information (often done to detect virtual machines) 17->159 31 cmd.exe 17->31         started        33 cmd.exe 17->33         started        35 cmd.exe 17->35         started        39 2 other processes 17->39 file6 signatures7 process8 file9 93 C:\Users\user\AppData\...\SysMonPort.vbs, ASCII 21->93 dropped 131 Windows Shell Script Host drops VBS files 21->131 133 Drops VBS files to the startup folder 21->133 135 Windows Scripting host queries suspicious COM object (likely to drop second stage) 21->135 137 WScript reads language and country specific registry keys (likely country aware script) 21->137 41 4 other processes 21->41 139 Uses WMIC command to query system information (often done to detect virtual machines) 25->139 46 2 other processes 25->46 48 2 other processes 27->48 50 2 other processes 29->50 52 2 other processes 31->52 54 2 other processes 33->54 56 2 other processes 35->56 58 4 other processes 37->58 60 3 other processes 39->60 signatures10 process11 dnsIp12 117 api.telegram.org 149.154.166.110, 443, 49718, 49719 TELEGRAMVG Netherlands 41->117 119 api.ipify.org 172.67.74.152, 443, 49717, 49720 CLOUDFLARENET-CloudflareIncUS Canada 41->119 97 C:\Users\user\AppData\...\SysMonPort.vbs, ASCII 41->97 dropped 141 Uses ping.exe to sleep 41->141 143 Windows Shell Script Host drops VBS files 41->143 145 Uses schtasks.exe or at.exe to add and modify task schedules 41->145 147 4 other signatures 41->147 62 cmd.exe 41->62         started        66 PING.EXE 1 41->66         started        69 cmd.exe 41->69         started        75 8 other processes 41->75 71 quser.exe 48->71         started        73 quser.exe 54->73         started        file13 signatures14 process15 dnsIp16 99 C:\Users\user\AppData\Roaming\...\sn.tmp, Unicode 62->99 dropped 161 Uses WMIC command to query system information (often done to detect virtual machines) 62->161 77 WMIC.exe 1 62->77         started        79 conhost.exe 62->79         started        107 127.0.0.1 unknown unknown 66->107 81 conhost.exe 69->81         started        83 schtasks.exe 69->83         started        85 conhost.exe 75->85         started        87 conhost.exe 75->87         started        89 schtasks.exe 75->89         started        91 5 other processes 75->91 file17 signatures18 process19
Score:
100%
Verdict:
Malware
File Type:
OFFICE
Link:
https://malprob.io/report/2b86f53965e6bf5ae33658293d3977894c8f31d7a86df9c24a677e020af0a3a3
Verdict:
Malware
YARA:
4 match(es)
Tags:
ADODB.Stream Blacklist VBA COM Behavior Trace DeObfuscated MSXML2.XMLHTTP Obfuscated Office Document SOS: 0.18 T1027 T1059 T1059.005 T1105 VBScript WScript.Shell
Link:
https://app.malva.re/file/6b8e049bf1c03e57e8dcb3817fc3eb5d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b86f53965e6bf5ae33658293d3977894c8f31d7a86df9c24a677e020af0a3a3/
Threat name:
Script.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-09-16 16:11:03 UTC
File Type:
Document
Extracted files:
31
AV detection:
12 of 23 (52.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fodpkolf427vvyzwlaut2olxrfgi6moxvbw7tqskm57aecxquorq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery execution macro persistence privilege_escalation
Link:
https://tria.ge/reports/260924-ng8y3scd53/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Runs ping.exe
Scheduled Task/Job: Scheduled Task
Script User-Agent
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Views/modifies file attributes
Enumerates physical storage devices
Executes a command shell one-liner
System Network Configuration Discovery: Internet Connection Discovery
Executes a VBScript file via the Windows Script Host.
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Looks up external IP address via web service
Checks computer location settings
Creates a file in the Startup directory
Badlisted process makes network request
Process spawned unexpected child process
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2b86f53965e6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2b86f53965e6bf5ae33658293d3977894c8f31d7a86df9c24a677e020af0a3a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments