MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e6c82000ecfdf70439ed68aa4b0aecb0033fd612037148d8347ebee6a3e7759. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e6c82000ecfdf70439ed68aa4b0aecb0033fd612037148d8347ebee6a3e7759
SHA3-384 hash: 38cf68d85d9bd055bce4e3a1169787ad425c0b881ec76fbf976480c0c19163b60706e2b4180116a1e0eb621b01e7776b
SHA1 hash: d105933f96f862a51218d160a215caa44e70c516
MD5 hash: d0c491b8eb3ea8f00a93af05ef1b8945
humanhash: pennsylvania-virginia-carolina-robin
File name:reg.dot
Download: download sample
File size:6'039 bytes
First seen:2021-04-30 13:11:25 UTC
Last seen:2021-04-30 13:32:53 UTC
File type:unknown
MIME type:application/octet-stream
ssdeep 96:dQh9oEM7MqHpR47doMl9Z53Fe94d4Gs2koiMkv4aHakfW/ghRwvhOFNabpNl6A:oZqQd5hsr3joxMtfYHpFbMA
TLSH 18C14BF0DCB47A35EF2A248142BDF58D0AE43D7605D75884306DDE3A1B88B7E4B214E9
Reporter info_sec_ca
Tags:CVE-2017-11882 dot

Intelligence

File Origin
# of uploads :
2
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27304.RtfHeur.BadVer.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Spam-473.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27333.RtfHeur.BadVer.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.FakeRTF-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.26244.RtfHeur.UNOFFICIAL
Create hunting rule

MiscreantPunch.RTF.EvilRTF.CVE-2017-0199-Obfus.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.RTFFakeVersionWithObjUpdateUKSurfMix.20200514.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e6c82000ecfdf70439ed68aa4b0aecb0033fd612037148d8347ebee6a3e7759/
Threat name:
Document-RTF.Exploit.CVE-2017-11882
Create hunting rule
Status:
Malicious
First seen:
2021-04-29 06:56:42 UTC
AV detection:
24 of 46 (52.17%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Exploit
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2e6c82000ecfdf70439ed68aa4b0aecb0033fd612037148d8347ebee6a3e7759

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

unknown 2e6c82000ecfdf70439ed68aa4b0aecb0033fd612037148d8347ebee6a3e7759

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1183461/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1185150/

Comments