MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53b891cd07ba659cbb5c1ced0b3099ce57990b4f90f8d27a36371df0b64060b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53b891cd07ba659cbb5c1ced0b3099ce57990b4f90f8d27a36371df0b64060b1
SHA3-384 hash: 4c3b8a2e899deec4dc2cf7bd11a0df3d3dfefc5e6e902ab0c94bd5f292147bea00fe879a8999ae653b493670ede2ccd5
SHA1 hash: 78e17c25e70007166e905a8b449c25d2ee2aac02
MD5 hash: f117b4935cd1eefe6b12dae144142c0e
humanhash: whiskey-lion-florida-snake
File name:Order #347585-159044-S dated 091020.doc
Download: download sample
File size:2'332'445 bytes
First seen:2020-09-10 08:13:17 UTC
Last seen:2020-09-10 08:38:03 UTC
File type:Word file doc
MIME type:text/rtf
ssdeep 1536:2oYJHyAfAbnWIyG6vGKj4bgIAtAB8n8WebFlpp2OjGS8x10AbCFvtp4HA2nhTXQv:3n
TLSH A4B5458A307511A163FA21D8FFDBF29A4D186E3FE049E1F49664E251068D44A3F97FB0
Reporter FORMALITYDE
Tags:doc

Intelligence

File Origin
# of uploads :
2
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
MiscreantPunch.RTF.2017-0199.Obfus.171711.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Launching a process
Creating a window
Creating a process with a hidden window
Running batch commands
Using the Windows Management Instrumentation requests
Launching the default Windows debugger (dwwin.exe)
DNS request
Sending an HTTP GET request
Deleting a recently created file
Bypassing of proactive protection methods using Windows Management Instrumentation (WMI)
Running batch commands by exploiting the app vulnerability
Creating a process from a recently created file
Launching a process by exploiting the app vulnerability
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/462947
Signature
Document exploit detected (creates forbidden files)
Found potential equation exploit (CVE-2017-11882)
Found suspicious RTF objects
Microsoft Office drops suspicious files
Multi AV Scanner detection for submitted file
Sigma detected: Office product drops script at suspicious location
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53b891cd07ba659cbb5c1ced0b3099ce57990b4f90f8d27a36371df0b64060b1/
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/200910-4pa15mqvpe/
Behaviour
Launches Equation Editor
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
NTFS ADS
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Office loads VBA resources, possible macro or embedded object present
Drops file in Windows directory
Drops file in System32 directory
Checks computer location settings
Blacklisted process makes network request
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Bloodhound
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/53b891cd07ba659cbb5c1ced0b3099ce57990b4f90f8d27a36371df0b64060b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_RTF_Embedded_OLE_PE
Create hunting rule
Author:Florian Roth
Description:Detects a suspicious string often used in PE files in a hex encoded object stream
Reference:https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Word file doc 53b891cd07ba659cbb5c1ced0b3099ce57990b4f90f8d27a36371df0b64060b1

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments