MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50a63763869837109a18b4f641550c6e04a851dcc0108ca02b44bc7d56702b3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50a63763869837109a18b4f641550c6e04a851dcc0108ca02b44bc7d56702b3a
SHA3-384 hash: a75097e6b204a607b5535c10cf1a3d9ff8d61ce734fd2d90c7e2f85f6faecf187d6be7b61eaa52ffc9ce389ffd8b8687
SHA1 hash: c0bc4bfe695c35e375627d8f4035173adea4803f
MD5 hash: 9906c54f58ca6940117b24c53a039739
humanhash: nine-queen-texas-network
File name:Order_Nr25502.xll
Download: download sample
File size:1'182'208 bytes
First seen:2022-05-05 10:25:58 UTC
Last seen:2022-05-05 10:53:09 UTC
File type:Excel file xll
MIME type:application/x-dosexec
imphash be710ba34b048ab0098050ccf62e369c (18 x Formbook, 14 x Dridex, 9 x AgentTesla)
ssdeep 12288:ynnnZq3Z2muWdP8bzbBSredEA3FgGdFsZbAeb40KR+OuLBjMa0q/PeGAPUXfQELL:ynnnZqpdRKX1+A6qwfN/0q0QLiNo8+
Threatray 114 similar samples on MalwareBazaar
TLSH T17E45F167E3C7FA70E6AE56BAC6B5DA28176E74A28175B74DB6404CCD39203438930F13
TrID 58.0% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
34.3% (.OCX) Windows ActiveX control (116521/4/18)
3.0% (.EXE) Win64 Executable (generic) (10523/12/4)
1.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.3% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:xll

Intelligence

File Origin
# of uploads :
2
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Order_Nr25502.xll
Verdict:
No threats detected
Analysis date:
2022-05-05 10:50:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f39acae0-c949-4f3b-bd7f-443ba107f8f8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.FileRepMalwareMisc.7087.8889.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Office Add-Ins - Suspicious
Link:
https://app.docguard.net/50a63763869837109a18b4f641550c6e04a851dcc0108ca02b44bc7d56702b3a/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6273a64275c6f158e80c7ab7/reports/148fae74-8b92-4051-8e72-a295f1dd01ce/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/988422
Signature
Document exploit detected (creates forbidden files)
Document exploit detected (process start blacklist hit)
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 620913 Sample: Order_Nr25502.xll Startdate: 05/05/2022 Architecture: WINDOWS Score: 68 23 Multi AV Scanner detection for submitted file 2->23 25 Initial sample is a PE file and has a suspicious name 2->25 27 Document exploit detected (process start blacklist hit) 2->27 8 cmd.exe 7 2 2->8         started        process3 process4 10 EXCEL.EXE 40 19 8->10         started        14 conhost.exe 8->14         started        dnsIp5 21 cdn.discordapp.com 162.159.135.233, 443, 49772 CLOUDFLARENETUS United States 10->21 31 Document exploit detected (creates forbidden files) 10->31 16 DW20.EXE 10->16         started        signatures6 process7 process8 18 DWWIN.EXE 22 6 16->18         started        signatures9 29 Query firmware table information (likely to detect VMs) 18->29
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/50a63763869837109a18b4f641550c6e04a851dcc0108ca02b44bc7d56702b3a/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-05-05 06:08:31 UTC
File Type:
PE (Dll)
Extracted files:
2
AV detection:
11 of 25 (44.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kctdoy4gta3rbgqywt3ecvimnyckquo4yaiiziblis6h2vtqfm5a._file
Verdict:
unknown
Similar samples:
1a443f4faa6f4187f8b4e90743b30c48bd33fe18602238a992316036d779f4f8
1cbc8581430d4a524a0805f30ce5368340fc943635c76de083527446508027b1
3b61599315b7b2f3c545912e143e618eba3cb8a494540d603f35df1253b1eaea
72e54878f1c063c5d48e40734f1fe23a3a19d965bf4205c3b45a7762ff68eaff
882312787d62f8bbebd46a7ce54207ec7eced13335de9ce6ae75a0a1e52dcb09
bac03f9b60b043b72ae8548b8915dd6058c71b6beae23652389b0cb9310af91d
ce5c54ac577153e15fb793c022b54fb473752b876525111d6aac97369e72e85e
fc80f7f615d4130160c30ec1c8e4cd885a7f42978ead2509cfdd350ad3547882
+ 104 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/220505-mghlfsfgc7/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Process spawned suspicious child process
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/50a63763869837109a18b4f641550c6e04a851dcc0108ca02b44bc7d56702b3a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Excel file xll 50a63763869837109a18b4f641550c6e04a851dcc0108ca02b44bc7d56702b3a

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments