MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b986bb2c26cdccb14aff9fef1ce54dca05abc6a04d1ea7fdba2d4b78c426c42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b986bb2c26cdccb14aff9fef1ce54dca05abc6a04d1ea7fdba2d4b78c426c42
SHA3-384 hash: fb8b69053482a66d95ea5602e9cbf09b9a2449c5d154b841d20e9f2198b0ac602fe8ee58724886549e02a19e399fc2bd
SHA1 hash: b621a41dc89071b52842cbb7238940c1805f5983
MD5 hash: a6c75c4c126c09daa4754fd4a2cef4b9
humanhash: moon-asparagus-juliet-wyoming
File name:payment.rtf
Download: download sample
File size:3'266 bytes
First seen:2020-05-09 16:18:11 UTC
Last seen:Never
File type:Rich Text Format (RTF) rtf
MIME type:text/rtf
ssdeep 48:8m/bDWTDZgOn+9Mw3gJpVjuvGjyEO1cN5SWhxT92NCXYF5RmYZqiQvExBM5JhcPO:8sIGOngwJ7KZCNhxEOYhXKvMMNS8D
Threatray 27 similar samples on MalwareBazaar
TLSH 67610BD86A4CF093E98E15B7CB5A3DB40595FC6FC7CDF1C440CDE66202A71B45958C49
Reporter JoulK
Tags:rtf

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27301.RtfHeur.BadVer.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.FakeRTF-2.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Document-Word.Exploit.CVE-2017-11882
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 15:00:11 UTC
File Type:
Document
Extracted files:
3
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0206919af0add6cabd8ee38f1dc151c65630f204c63d4c145105c52f67c23de2
3484fffe14e6d045c8a5c568187f686d4479693dadb3fc4631b7d307000b5148
654dcb8cbaca77d6679523c36f44ea656e39a97ce7e4d6f91b089fe8d54f9787
7308b321667d579fbab79329977c8396721f9211be62b99b3abb3ae8e49dbcb4
82421fe6bfd0fa95f4bc1813c1dbaf3ce1fc505f2e04dafefc653316e0f1f547
8a6bf2bc00a6d746dd60c82d00c5a226ffda03638cdcc937a0acb090363562ab
d35aeec2558b2fbbfddb761ecdef94c1c6b085af83d6905ab7851af1217c1543
ec4b8a8c2223163d74c1c9b97e26889074e995beea8e9a78ba3a8a430fde7bd0
f17d48c8d179de191e519fa908648b977c09f91803b898d8e4fada52e423a8df
f696348658a9b89041b6bf9bdc9a3ae8f3799c5beee76e42dc81f096307c7847
+ 17 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-5q3ljwwz4j/
Behaviour
Launches Equation Editor
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks processor information in registry
Enumerates system info in registry
Office loads VBA resources, possible macro or embedded object present
Drops file in Windows directory
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:win_alina_pos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_gootkit_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Rich Text Format (RTF) rtf 6b986bb2c26cdccb14aff9fef1ce54dca05abc6a04d1ea7fdba2d4b78c426c42

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments