MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69eb4fca412201039105d862d5f2bf12085d41cb18a93398afef0be8dfb9c229. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	69eb4fca412201039105d862d5f2bf12085d41cb18a93398afef0be8dfb9c229
SHA3-384 hash:	92f02e3f436eba0511d5132cb70d4039970c4788859c148e58e4432f8b6a8971af63b2666dd136f4319d99e598ff57fc
SHA1 hash:	f1d0114e7a40691bdd6914e2f9885cdfb1235c79
MD5 hash:	701270f377771368084d8a07857f3420
humanhash:	iowa-one-sierra-cup
File name:	69eb4fca412201039105d862d5f2bf12085d41cb18a93398afef0be8dfb9c229.docx
Download:	download sample
File size:	24'451 bytes
First seen:	2025-11-11 14:21:31 UTC
Last seen:	Never
File type:	doc
MIME type:	application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep	384:dbkoerIMReGvZBVIG0r7jXHiz0u2nJN64Mqizxm4XhN9DbCpPAXbCjze7K72q:tUr/4eVonbHiwu2nJN6iizxm4D9/CpPz
TLSH	T1B5B2D0B9ED40AC38E857733A961601C1BF0ADA83E11AD36F5839B0D88B148635B7F589
TrID	52.2% (.DOCX) Word Microsoft Office Open XML Format document (23500/1/4) 38.8% (.ZIP) Open Packaging Conventions container (17500/1/4) 8.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	docx
Reporter	CyberPanda
Tags:	APT42 doc

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

199

Origin country :

US

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

69eb4fca412201039105d862d5f2bf12085d41cb18a93398afef0be8dfb9c229.docx

Verdict:

No threats detected

Analysis date:

2025-11-11 14:23:31 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/7cc0cf6c-24be-4128-a73a-ab3556cbf8a4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

BitDam Legit

Verdict:

Legit

File type:

application/msword

Has a screenshot:

False

Contains macros:

False

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69134697ac1ae236e1796efe

Tags:

remo

DocGuard Clean

Result

Verdict:

Clean

File Type:

OOXML Word File

Link:

https://app.docguard.net/69eb4fca412201039105d862d5f2bf12085d41cb18a93398afef0be8dfb9c229/results/dashboard

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/69134696413b181bff20d2e2/reports/fe6e7b9c-2588-4d20-b6d7-4ef58732f61c/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/69eb4fca412201039105d862d5f2bf12085d41cb18a93398afef0be8dfb9c229

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

/10

Score Malicious:

%

Score Benign:

1%

Link:

https://www.malware.ai/gui/files/?id=dc5f4ba9-5ae4-465d-9552-50ce634670e6

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

docx

First seen:

2025-11-11T11:36:00Z UTC

Last seen:

2025-11-11T12:01:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/69eb4fca412201039105d862d5f2bf12085d41cb18a93398afef0be8dfb9c229/results?tab=lookup

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

OFFICE

Link:

https://malprob.io/report/69eb4fca412201039105d862d5f2bf12085d41cb18a93398afef0be8dfb9c229

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Office Document

Link:

https://app.malva.re/file/701270f377771368084d8a07857f3420

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/69eb4fca412201039105d862d5f2bf12085d41cb18a93398afef0be8dfb9c229/

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/69eb4fca412201039105d862d5f2bf12085d41cb18a93398afef0be8dfb9c229

ReversingLabs TitaniumCloud Document.Trojan.Heuristic

Threat name:

Document.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2022-11-30 10:39:27 UTC

File Type:

Document

Extracted files:

12

AV detection:

3 of 23 (13.04%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nhvu7ssbeiaqheif3brnl4v7cief2qoldcuthgfp54f6rx5zyiuq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/251111-rpnjwsfk8y/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/2c39d857-2b3a-4c64-bad5-b1d106cdcd17

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/69eb4fca412201039105d862d5f2bf12085d41cb18a93398afef0be8dfb9c229