MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 462bf8a2e19a3e2dd4e5635aa5089e7bdc291d5c5c4665549f64f67abf0b598a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 462bf8a2e19a3e2dd4e5635aa5089e7bdc291d5c5c4665549f64f67abf0b598a
SHA3-384 hash: 5a4fd13741c8952561ad7d1edd8b9efe845f5f9ac4dfa704cdca13b93e33c53d30be0efc4a2eb27a7b1697cacd3e1b02
SHA1 hash: f2c15ca4740fb2a1c11e8cd55181ba97caae3c77
MD5 hash: 8ae07041e2b2c7201571f3b9541c3925
humanhash: hotel-equal-november-bacon
File name:New Section 1.one
Download: download sample
File size:704'320 bytes
First seen:2023-03-30 08:37:03 UTC
Last seen:Never
File type:Microsoft OneNote (one) one
MIME type:application/octet-stream
ssdeep 12288:CIjHiImv+fuHiMRLAlR88CQaAY3MjplVTK57xg/96LxY55W:DjH3+PiMRL98CkY3MrVqSs
TLSH T14AE423E2CC72C824D9C300BA2983FAA544509ADFFD5A5E2324713B0D75F5BD49A9387E
Reporter 0xToxin
Tags:172-245-45-213 kento one PerceptionPoint pw - 01234 Redline

Intelligence

File Origin
# of uploads :
1
# of downloads :
759
Origin country :
IL IL
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.28794.Heur.BadOne.exe.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.OneNotePkillExeExtDetonationRulingTheNation.20230125.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
File Type:
OneNote File - Corrupted
Link:
https://app.docguard.net/462bf8a2e19a3e2dd4e5635aa5089e7bdc291d5c5c4665549f64f67abf0b598a/results/dashboard
Verdict:
Unknown
Threat level:
  0/10
Confidence:
80%
Link:
https://www.filescan.io/uploads/64254a6c0dc8b8a71cf78bf3/reports/c56b3355-96b6-4152-b6b4-ace1f13fd0c2/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/462bf8a2e19a3e2dd4e5635aa5089e7bdc291d5c5c4665549f64f67abf0b598a
Result
Verdict:
SUSPICIOUS
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
1 / 100
Link:
https://www.joesandbox.com/analysis/1204966
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/462bf8a2e19a3e2dd4e5635aa5089e7bdc291d5c5c4665549f64f67abf0b598a/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iyv7rixbti7c3vhfmnnkkce6ppocshk4lrdgkve7mt3hvpyllgfa._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/230330-kh7kvsbg63/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Drops file in Program Files directory
Drops file in Windows directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/462bf8a2e19a3e2dd4e5635aa5089e7bdc291d5c5c4665549f64f67abf0b598a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:OneNote_EmbeddedFiles_NoPictures
Create hunting rule
Author:Nicholas Dhaeyer - @DhaeyerWolf
Description:OneNote files that contain embedded files that are not pictures.
Reference:https://blog.didierstevens.com/2023/01/22/analyzing-malicious-onenote-documents/
Rule name:OneNote_magic
Create hunting rule
Author:Stuart Gonzalez
Rule name:SUSP_OneNote
Create hunting rule
Author:spatronn
Description:Hard-Detect One

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments