MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45386816654e229126f004100621360ea2501c4b71eab09bddfd97785b3c42e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	45386816654e229126f004100621360ea2501c4b71eab09bddfd97785b3c42e2
SHA3-384 hash:	911efbd0fa78ab3de5e08fa725f305bd78d3b9b780fa4e9a208bb3bfd76bae64b49ddc90b5886b2f61f25901ea886dcf
SHA1 hash:	3417776a79553cf0136e8f890b789806272badf4
MD5 hash:	268007760567310e9a6abfa2edbce02e
humanhash:	nine-texas-beryllium-arizona
File name:	attach#6081-18-03-2024.xlsx
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	58'894 bytes
First seen:	2024-03-18 16:53:01 UTC
Last seen:	2024-03-18 18:52:17 UTC
File type:	xlsx
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	768:bnaZ932qpaOKFSGOJdGvoZCPAUJ1YxBardD2TSWGdCIKD13zegYN1T/wRI:gJ2u4OPKIxoEuDKNzexToRI
TLSH	T10A43D048E78BCCE1C660A576444F17797735A180CBC0FE4E8A78EC720BC67A52F5A8D9
TrID	60.1% (.XLSX) Excel Microsoft Office Open XML Format document (34000/1/7) 30.9% (.ZIP) Open Packaging Conventions container (17500/1/4) 7.0% (.ZIP) ZIP compressed archive (4000/1) 1.7% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	James_inthe_box
Tags:	DarkGate xlsx

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

2'716

Origin country :

US

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

45386816654e229126f004100621360ea2501c4b71eab09bddfd97785b3c42e2.xlsx

Verdict:

No threats detected

Analysis date:

2024-03-18 16:55:20 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/2f481248-1bef-4fd4-bcaa-be76b183b9e0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

BitDam Legit

Verdict:

Legit

File type:

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

Has a screenshot:

False

Contains macros:

False

ClamAV Detected

Detection(s):

SecuriteInfo.com.IMG.Phish.11001.6430.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.30436.XmlHeur.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.RelsFileDottedQuadDancingInHeaven.20240216.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Changing an executable file

Using the Windows Management Instrumentation requests

Creating a window

Сreating synchronization primitives

Searching for the window

Infecting executable files

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

OOXML Excel File

Link:

https://app.docguard.net/45386816654e229126f004100621360ea2501c4b71eab09bddfd97785b3c42e2/results/dashboard

Behaviour

BlacklistAPI detected

Document image

Image:

Download PNG

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

explorer lolbin macros-on-open

Link:

https://www.filescan.io/uploads/65f87173b8cdeee19e6ef6c9/reports/5feebdf2-80d6-4026-bb78-0202848d34fc/overview

Hybrid Analysis W97M/Dldr.TempInj

Verdict:

Suspicious

Labled as:

W97M/Dldr.TempInj

Link:

https://www.hybrid-analysis.com/sample/45386816654e229126f004100621360ea2501c4b71eab09bddfd97785b3c42e2

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

9.1/10

Score Malicious:

91%

Score Benign:

9%

Link:

https://www.malware.ai/gui/files/?id=3d91286d-e2e1-4c51-aa19-7a577a8a3317

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1411203

Signature

Contains functionality to register a low level keyboard hook

Detected suspicious Microsoft Office reference URL

Document exploit detected (process start blacklist hit)

Document Viewer accesses SMB path (likely to steal NTLM hashes or to download payload)

Installs new ROOT certificates

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Opens network shares

Sigma detected: Legitimate Application Dropped Executable

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious Microsoft Office Child Process

Snort IDS alert for network traffic

Suspicious execution chain found

Uses certutil -decode

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/45386816654e229126f004100621360ea2501c4b71eab09bddfd97785b3c42e2/

ReversingLabs TitaniumCloud Document-Excel.Trojan.Heuristic

Threat name:

Document-Excel.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-03-18 16:53:00 UTC

File Type:

Document

Extracted files:

14

AV detection:

6 of 24 (25.00%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iu4gqftfjyrjcjxqaqiamijwb2rfahclohvlbg657wlxqwz4ilra._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/240318-vdy32ade75/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/45386816654e229126f004100621360ea2501c4b71eab09bddfd97785b3c42e2