MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44f589fd240736f97ceeb448eaabc90b8a234d7f1cd78b7ded2d62b47f9f2e13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Maldoc score: 7


Intelligence 7 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44f589fd240736f97ceeb448eaabc90b8a234d7f1cd78b7ded2d62b47f9f2e13
SHA3-384 hash: 98b60e5575c6b01c0fd92c970a450eeebb6fab183758351166bca2613c7b8907e18c8b90f566d5caa882771c65f8bd63
SHA1 hash: f6b4f2f3cb7685c8d110417fa4984e0e2b74d979
MD5 hash: 977b18a8273765c7f922e4d4cbaf5001
humanhash: cold-victor-oranges-snake
File name:Simulador junio 2026.xlsm
Download: download sample
File size:132'839 bytes
First seen:2026-06-04 05:52:32 UTC
Last seen:Never
File type:Excel file xlsm
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep 3072:M3mLhhqbS8VVIaMM6nJseS4HC292ZfzkP8wIsCsM/Q5laf6f:MivOfEZnJseS4io2Dsq1fG
TLSH T149D302068801F5C1C77F163A76A5C177021A2665B2E8C26EBF04E7EA260DC57274EBDD
TrID 42.4% (.XLAM) Excel Macro-enabled Open XML add-in (83500/1/13)
29.2% (.XLSM) Excel Microsoft Office Open XML Format document (with Macro) (57500/1/12)
17.3% (.XLSX) Excel Microsoft Office Open XML Format document (34000/1/7)
8.9% (.ZIP) Open Packaging Conventions container (17500/1/4)
2.0% (.ZIP) ZIP compressed archive (4000/1)
Magika xlsx
Reporter abuse_ch
Tags:xlsm

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 7
File Format is MS Excel 2007+
Container Format is OpenXML
Office document contains VBA Macros
Embedded Images

MalwareBazaar found the following images embedded in this file:

MD5 hashdc.creator# of relations
f5939084d114c0b6b84f8528e8e17162Angela Camargo2
51ef929ad30313a869ecbfa16c26c485Angela Camargo2
OLE dump

MalwareBazaar was able to identify 19 sections in this file using oledump:

Section IDSection sizeSection name
A1625 bytesPROJECT
A2143 bytesPROJECTwm
A3998 bytesVBA/Hoja1
A41179 bytesVBA/Hoja2
A5998 bytesVBA/Hoja3
A61007 bytesVBA/Mdulo1
A72380 bytesVBA/Mdulo2
A81007 bytesVBA/ThisWorkbook
A93154 bytesVBA/_VBA_PROJECT
A102643 bytesVBA/__SRP_0
A11222 bytesVBA/__SRP_1
A12703 bytesVBA/__SRP_2
A13156 bytesVBA/__SRP_3
A14464 bytesVBA/__SRP_4
A15106 bytesVBA/__SRP_5
A16169 bytesVBA/__SRP_6
A17156 bytesVBA/__SRP_7
A18633 bytesVBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
SuspiciousHex StringsHex-encoded strings were detected, may beused to obfuscate strings (option --decode tosee all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
132
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
MSO
Details
MSO
extracted OLE packages, if they are present within the input OOXML document
Link:
https://research.acce.ciphertechsolutions.com/results/4948da32-ec5d-4d5f-b54c-9f7d7225254e/
Malware family:
n/a
ID:
1
File name:
xlsm
Verdict:
No threats detected
Analysis date:
2026-06-04 05:55:14 UTC
Tags:
macros
Link:
https://app.any.run/tasks/6cf66c15-03ae-454c-b1a4-01ee1351f79a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Legit
File type:
text/xml
Has a screenshot:
False
Contains macros:
False
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/68935/
Detection(s):
TwinWave.EvilDoc.EmotetEsqXL4EarlyHours.20211126.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a2112dbf8676ad4d360e94a
Tags:
office macro micro
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Result
Verdict:
Clean
File Type:
Excel File with Macro
Link:
https://app.docguard.net/44f589fd240736f97ceeb448eaabc90b8a234d7f1cd78b7ded2d62b47f9f2e13/results/dashboard
Document image
Image:
Download PNG
Document image
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/44f589fd240736f97ceeb448eaabc90b8a234d7f1cd78b7ded2d62b47f9f2e13
Label:
Benign
Suspicious Score:
/10
Score Malicious:
%
Score Benign:
1%
Link:
https://www.malware.ai/gui/files/?id=215c7618-91ee-4abc-9b7b-41ac6eab9bde
Verdict:
Clean
File Type:
xlsm
Link:
https://opentip.kaspersky.com/44f589fd240736f97ceeb448eaabc90b8a234d7f1cd78b7ded2d62b47f9f2e13/results?tab=lookup
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
5 / 100
Link:
https://www.joesandbox.com/analysis/1922655
Behaviour
Behavior Graph:
n/a
Score:
98%
Verdict:
Malware
File Type:
OFFICE
Link:
https://malprob.io/report/44f589fd240736f97ceeb448eaabc90b8a234d7f1cd78b7ded2d62b47f9f2e13
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44f589fd240736f97ceeb448eaabc90b8a234d7f1cd78b7ded2d62b47f9f2e13/
Verdict:
Susipicious
Link:
https://tip.neiki.dev/file/44f589fd240736f97ceeb448eaabc90b8a234d7f1cd78b7ded2d62b47f9f2e13
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=it2yt7jea43ps7howreovk6jbofcgtl7dtlyw7pnfvrli747fyjq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro
Link:
https://tria.ge/reports/260604-glhjcsbt3r/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/44f589fd240736f97ceeb448eaabc90b8a234d7f1cd78b7ded2d62b47f9f2e13

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:TA505_Maldoc_21Nov_2
Create hunting rule
Author:Arkbird_SOLG
Description:invitation (1).xls
Reference:https://twitter.com/58_158_177_102/status/1197432303057637377
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/68935/

Comments