MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77b18778c6708fa36be4d1cbcbe560e0824edfd09277c721d4d76b080bbb976d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	77b18778c6708fa36be4d1cbcbe560e0824edfd09277c721d4d76b080bbb976d
SHA3-384 hash:	2aca05d159d88778b50bc14d285c33ca5df28a88e2aa6fd4f69c2cbab940c4c6a7bf124f2541a22b999a3c08258d2f39
SHA1 hash:	be64172de97bb590bbfdfe11b2c8f9c51306842c
MD5 hash:	28e436f7e615a392d6054e4e4104aa1e
humanhash:	oklahoma-eight-saturn-colorado
File name:	statapril2024-2420.xlsx
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	58'228 bytes
First seen:	2024-04-09 14:58:43 UTC
Last seen:	Never
File type:	xlsx
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	768:ZFnM1dDlT2qpaOKFSGOJdGvoZCPAUJ1YxBardD2TSWGdCIKD15ogXnlq5bj:/mZ2u4OPKIxoEuDKJnlij
TLSH	T17F43E108E79ECCE1C651A575044F57B83639A2D4CAC0FF4A8A39FCB54BC23A51EAB5C4
TrID	60.1% (.XLSX) Excel Microsoft Office Open XML Format document (34000/1/7) 30.9% (.ZIP) Open Packaging Conventions container (17500/1/4) 7.0% (.ZIP) ZIP compressed archive (4000/1) 1.7% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	DarkGate xlsx

cocaman

Malicious email (T1566.001)
From: "841741486 <contact@lakebid.com>" (likely spoofed)
Received: "from lakebid.com (lakebid.com [62.210.130.162]) "
Date: "Tue, 9 Apr 2024 16:58:17 +0200"
Subject: "PARCHASE ORDER - 53498628"
Attachment: "statapril2024-2420.xlsx"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

2'670

Origin country :

CH

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

77b18778c6708fa36be4d1cbcbe560e0824edfd09277c721d4d76b080bbb976d.xlsx

Verdict:

No threats detected

Analysis date:

2024-04-09 15:01:31 UTC

Tags:

smb policy

Link:

https://app.any.run/tasks/7684d7be-8074-413f-838a-51ea423e8151

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Using the Windows Management Instrumentation requests

Creating a window

Сreating synchronization primitives

Launching a process

Moving a file to the Program Files subdirectory

Replacing files

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

OOXML Excel File

Link:

https://app.docguard.net/77b18778c6708fa36be4d1cbcbe560e0824edfd09277c721d4d76b080bbb976d/results/dashboard

Behaviour

BlacklistAPI detected

Document image

Image:

Download PNG

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

explorer lolbin

Link:

https://www.filescan.io/uploads/661557b935699b4745c33cef/reports/2306b4aa-6e55-4282-b251-7b3644570caf/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/77b18778c6708fa36be4d1cbcbe560e0824edfd09277c721d4d76b080bbb976d

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

9.1/10

Score Malicious:

92%

Score Benign:

8%

Link:

https://www.malware.ai/gui/files/?id=8925e83b-80cd-4c27-b2b7-2bb380391481

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.spyw.expl

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1423099

Signature

Detected suspicious Microsoft Office reference URL

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Opens network shares

Yara detected MalDoc

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/77b18778c6708fa36be4d1cbcbe560e0824edfd09277c721d4d76b080bbb976d/

ReversingLabs TitaniumCloud Document-Word.Downloader.Darkgate

Threat name:

Document-Word.Downloader.Darkgate

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-04-09 14:58:48 UTC

File Type:

Document

Extracted files:

14

AV detection:

10 of 24 (41.67%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o6yyo6ggoch2g27e2hf4xzla4cbe5x6qsj34oiou25vqqc53s5wq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/240409-scqn6aab22/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/77b18778c6708fa36be4d1cbcbe560e0824edfd09277c721d4d76b080bbb976d