MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4eea330f8fdd2a503795c9b25346b3e752ba18b7ef2c776fff5b21bdc8a8e12e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4eea330f8fdd2a503795c9b25346b3e752ba18b7ef2c776fff5b21bdc8a8e12e
SHA3-384 hash:	077601b7907998a63be3cdeaf72edbdce941980086f099b4d353be4d6cfc6745b303d002f441953185c6cc929a2a22ce
SHA1 hash:	f0f3b496ae64e5115fd39a00dff04b351c84f941
MD5 hash:	5f788c0a85f200cc321cd0593a18ffa0
humanhash:	pizza-neptune-nineteen-nebraska
File name:	Holiday Survey Fraud 996188331.xlsb
Download:	download sample
Signature	Dridex Alert Create hunting rule
File size:	108'123 bytes
First seen:	2021-11-29 14:38:01 UTC
Last seen:	Never
File type:	xlsx
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	3072:b/b95ZIJSjq0gQ+5dZZCDZpyYl+fw5snd3Wgd+PH:vd4SjNgJ5dZEZLod+v
TLSH	T122B302AD662AD025C54F5C3E905B7DEAF221C41194C0EA71B279307C8E23A37175E5EE
Reporter	JAMESWT_WT
Tags:	Dridex xlsb xlsx

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

193

Origin country :

n/a

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Holiday Survey Fraud 996188331.xlsb

Verdict:

Malicious activity

Analysis date:

2021-11-29 14:40:17 UTC

Tags:

macros40

Link:

https://app.any.run/tasks/6033ff93-70ce-4b42-b986-244d6ccd0b16

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

BitDam Malicious

Verdict:

Malicious

File type:

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

Has a screenshot:

False

Contains macros:

False

ClamAV Detected

Detection(s):

TwinWave.EvilDoc.XL4MDridexYourStringShilouette.20211102.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.XL4MDridexRunningDownTheDream.20211115.UNOFFICIAL

Alert

Create hunting rule

securiteinfo.com.xls4.icedid.42146.12007.16787.UNOFFICIAL

Alert

Create hunting rule

securiteinfo.com.xls4.icedid.42146.24744.28531.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

DNS request

Creating a window

Сreating synchronization primitives

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

OOXML Excel File with Excel4Macro

Link:

https://app.docguard.net/4eea330f8fdd2a503795c9b25346b3e752ba18b7ef2c776fff5b21bdc8a8e12e/results/dashboard

Document image

Image:

Download PNG

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive mshta stripped

Link:

https://www.filescan.io/uploads/61a4e5cebbfd2af97cba22a0/reports/0850c81e-a4e8-4113-8cc7-50c7a3ef6187/overview

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/898004

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4eea330f8fdd2a503795c9b25346b3e752ba18b7ef2c776fff5b21bdc8a8e12e/

ReversingLabs TitaniumCloud Document-Excel.Infostealer.Dridex

Threat name:

Document-Excel.Infostealer.Dridex

Alert

Create hunting rule

Status:

Malicious

First seen:

2021-11-29 14:38:10 UTC

File Type:

Document

Extracted files:

20

AV detection:

19 of 27 (70.37%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j3vdgd4p3uvfan4vzgzfgrvt45jlugfx54who377lmq33sfi4exa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

macro xlm

Link:

https://tria.ge/reports/211129-rzqr1afcf2/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4eea330f8fdd2a503795c9b25346b3e752ba18b7ef2c776fff5b21bdc8a8e12e