MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30e0259012e5808f7a34b0a9c7fba9194ae40bfa6fcba4a6f28787623a5f8cb1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	30e0259012e5808f7a34b0a9c7fba9194ae40bfa6fcba4a6f28787623a5f8cb1
SHA3-384 hash:	907a37fae5ba9fc8ebb470d99a2beda1c887a5040c0ca30734bb532b5aa79a4a2c2fe3e0b01aec7d22e989e1c56e7bd1
SHA1 hash:	41ec569c2e6dde09b588092c01af599fdb8b3101
MD5 hash:	2067ab5c7dccaf617d8bcd49d82377e7
humanhash:	nitrogen-tennessee-wolfram-six
File name:	MT103-539 PAYMENT (1).docx
Download:	download sample
Signature	VIPKeylogger Alert Create hunting rule
File size:	327'351 bytes
First seen:	2024-10-22 06:43:27 UTC
Last seen:	Never
File type:	doc
MIME type:	application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep	6144:107JHBA0B56szCXqqqqqmzYhuO+FLh5C2z9mL9:+d/qYYFNHrz98
TLSH	T1976412050C9780C8830A7859F1A8151E2B6F9C339D63C8359BFDD6BB4AA59CCD7B7B48
TrID	52.2% (.DOCX) Word Microsoft Office Open XML Format document (23500/1/4) 38.8% (.ZIP) Open Packaging Conventions container (17500/1/4) 8.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	docx
Reporter	lowmal3
Tags:	doc VIPKeylogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

2'998

Origin country :

DE

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

30e0259012e5808f7a34b0a9c7fba9194ae40bfa6fcba4a6f28787623a5f8cb1

Verdict:

Suspicious activity

Analysis date:

2024-10-22 00:42:46 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/bd570076-4c2f-4381-b7c8-5683abf7729e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

TwinWave.EvilDoc.OkayLureDefenderWord.20220418.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.27321.XmlHeur.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.30525.XmlHeur.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.XML.Downloader-4.UNOFFICIAL

Alert

Create hunting rule

Doc.Downloader.Loda-7570590-0

Alert

Create hunting rule

TwinWave.EvilDoc.RelsPublicDottedQuadDancingInHeaven.20211202.UNOFFICIAL

Alert

Create hunting rule

MiscreantPunch.Suspicious.RemoteTemplateCall.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6716f5069e67c2468202f13a

Tags:

Office Agent Micro

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Using the Windows Management Instrumentation requests

Creating a window

Creating a file

DNS request

Connection attempt

Sending a custom TCP request

Launching a process by exploiting the app vulnerability

Connection attempt to an infection source by exploiting the app vulnerability

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

OOXML Word File

Link:

https://app.docguard.net/30e0259012e5808f7a34b0a9c7fba9194ae40bfa6fcba4a6f28787623a5f8cb1/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/671749b47184660038537605/reports/82604080-68a1-42ec-94b2-53de8a4fbc1b/overview

Hybrid Analysis CVE-2017-11882

Verdict:

Malicious

Labled as:

CVE-2017-11882

Link:

https://www.hybrid-analysis.com/sample/30e0259012e5808f7a34b0a9c7fba9194ae40bfa6fcba4a6f28787623a5f8cb1

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

9.5/10

Score Malicious:

96%

Score Benign:

4%

Link:

https://www.malware.ai/gui/files/?id=c2389a9a-933c-4462-8b81-e9d7ae8d696d

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/30e0259012e5808f7a34b0a9c7fba9194ae40bfa6fcba4a6f28787623a5f8cb1

Details

IPv4 Dotted Quad URL

A URL was detected referencing a direct IP address, as opposed to a domain name.

External Relationship Element

Document contains an externally hosted relationship, which fetches further content.

Joe Sandbox PureLog Stealer, Snake Keylogger, VIP Ke

Result

Threat name:

PureLog Stealer, Snake Keylogger, VIP Ke

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1539127

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains an external reference to another file

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Document exploit detected (process start blacklist hit)

Found malware configuration

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Microsoft Office drops suspicious files

Microsoft Office launches external ms-search protocol handler (WebDAV)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Office viewer loads remote template

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: Equation Editor Network Connection

Sigma detected: File Dropped By EQNEDT32EXE

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Sigma detected: Suspicious Microsoft Office Child Process

Suricata IDS alerts for network traffic

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Yara detected PureLog Stealer

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

OFFICE

Link:

https://malprob.io/report/30e0259012e5808f7a34b0a9c7fba9194ae40bfa6fcba4a6f28787623a5f8cb1

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/30e0259012e5808f7a34b0a9c7fba9194ae40bfa6fcba4a6f28787623a5f8cb1/

ReversingLabs TitaniumCloud Document-Word.Trojan.Groooboor

Threat name:

Document-Word.Trojan.Groooboor

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-10-21 15:15:40 UTC

File Type:

Document

Extracted files:

12

AV detection:

14 of 24 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gdqcleas4wai66ruwcu4p65jdffoic72n7f2jjxsq6dweos7rsyq._file

Threatray unknown_loader_037 vipkeylogger

Verdict:

malicious

Label(s):

unknown_loader_037

Alert

Create hunting rule

vipkeylogger

Alert

Create hunting rule

Similar samples:

error

VIPKeylogger

Hatching Triage vipkeylogger

Result

Malware family:

vipkeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vipkeylogger collection discovery execution keylogger spyware stealer

Link:

https://tria.ge/reports/241022-hhg9vsvbql/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Launches Equation Editor

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

outlook_office_path

outlook_win_path

Office loads VBA resources, possible macro or embedded object present

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Drops file in System32 directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Abuses OpenXML format to download file from external location

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

VIPKeylogger

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/546229a7-7cb6-4595-be6f-ff0d74e512c3

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/30e0259012e5808f7a34b0a9c7fba9194ae40bfa6fcba4a6f28787623a5f8cb1