MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 727a5978e88a3fd2afd1ae7003cee18e31bd06555718597763908785989d9e85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 727a5978e88a3fd2afd1ae7003cee18e31bd06555718597763908785989d9e85
SHA3-384 hash: b03f8813785f80f6d62d4bfe328c8bce81b19b537872f32468796ffc6a7ec403fa35797420689fb06f9f468a31c44d12
SHA1 hash: 49618c7f3934327919da186542b670ec49f224e8
MD5 hash: c480010c08543cadc1a99d4291b974a4
humanhash: oranges-alanine-sad-violet
File name:PO2.xll
Download: download sample
File size:652'288 bytes
First seen:2022-04-15 07:02:49 UTC
Last seen:Never
File type:Excel file xll
MIME type:application/x-dosexec
imphash be710ba34b048ab0098050ccf62e369c (18 x Formbook, 14 x Dridex, 9 x AgentTesla)
ssdeep 12288:D0Ws7IMtR4yVld8bzbBSre6PMgFK/UqW1:D0bdkX1hcL
Threatray 110 similar samples on MalwareBazaar
TLSH T173D46C55BECA6EA1EFBF47BB8361D62D0226735D03A1A6CF360305993951FC2453EA03
TrID 58.0% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
34.3% (.OCX) Windows ActiveX control (116521/4/18)
3.0% (.EXE) Win64 Executable (generic) (10523/12/4)
1.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.3% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:xll

Intelligence

File Origin
# of uploads :
1
# of downloads :
331
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO2.xll
Verdict:
No threats detected
Analysis date:
2022-04-15 07:18:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/671cd94e-36df-4022-82fd-8516bc331eee

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.DownloaderNET.312.27193.19952.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Office Add-Ins - Suspicious
Link:
https://app.docguard.net/727a5978e88a3fd2afd1ae7003cee18e31bd06555718597763908785989d9e85/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm greyware packed packed
Link:
https://www.filescan.io/uploads/625918a9482f2f41cab36f3d/reports/fbcd4e02-bf1d-4195-9349-013b9007fb4a/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/727a5978e88a3fd2afd1ae7003cee18e31bd06555718597763908785989d9e85/
Threat name:
ByteCode-MSIL.Trojan.ExcelAddin
Create hunting rule
Status:
Malicious
First seen:
2022-04-15 00:47:01 UTC
File Type:
PE (Dll)
Extracted files:
3
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oj5fs6hiri75fl6rvzyahtxbryy32bsvk4mfs53dscdylge5t2cq._file
Verdict:
malicious
Similar samples:
0d39c74b9b2d8f9f6986b5ca4bba3f47e75e3ec3ee14c6ecf9beb350fb08d56f
97e21c7a37cbdb5cff93a18cce5b5495574be821d999e0e876c8be48ab56ca6e
b208a4a53f2622d6c62ecf258987a2038dad2255739f089e8994acc8f6ea0026
b99ee6d1625f7b0c9685c3bb49173c4425e39fbfe6a1a4eb6faf039b1ecbbfb8
cbbfb438d9293b284bd6181e6ede7b2929772817736ff27aef7baa6484daeabd
ce5c54ac577153e15fb793c022b54fb473752b876525111d6aac97369e72e85e
d838c7ad537e71dab1b968088db4b08195429a5ba6c22fdacad992caf27082a0
df22b02f086ac431a0d5687e0b4e96bf57f854bc0f006abb0e8fc67a8d7a7107
fbfaa1c4f9d13a4c6043bc66e71df3304be8bf8eec0277680c65c2bef402513b
fc80f7f615d4130160c30ec1c8e4cd885a7f42978ead2509cfdd350ad3547882
+ 100 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/220415-hvkwhsdfb8/
Behaviour
Suspicious use of SetWindowsHookEx
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/727a5978e88a3fd2afd1ae7003cee18e31bd06555718597763908785989d9e85

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:t0_1
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Excel file xll 727a5978e88a3fd2afd1ae7003cee18e31bd06555718597763908785989d9e85

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments