🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77fdfc5339e10e1511f87bdd27f94463786381ef30d01fc9efc01c1a0dab0a85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Maldoc score: 17


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77fdfc5339e10e1511f87bdd27f94463786381ef30d01fc9efc01c1a0dab0a85
SHA3-384 hash: 98117148744ad243618272135a98dbfdf22401ac5ab01b7205cc6e344de4b3bb97a283094c6a1913cbc0a1736a9c844a
SHA1 hash: da2125cee0845ec929437ed4b9f0fdb31ef10bee
MD5 hash: 98e4f5daae423b6b37e6e1dce681a812
humanhash: undress-queen-fifteen-ack
File name:vbaProject.bin
Download: download sample
File size:80'896 bytes
First seen:2024-11-16 12:57:04 UTC
Last seen:Never
File type:Excel file xls
MIME type:application/CDFV2
ssdeep 1536:PXNtm0GrcQ8I0bpUKxEGKqeli1g8eli1s:PXNtm07Q8I8pUKxEGxKiu8KiC
TLSH T12E839211BA56CA33D6840E374CDAE6E97739BD01AE05821331A4B77F6E7FB90CA12740
Magika xls
Reporter NDA0E
Tags:IcedID xls

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 17
OLE dump

MalwareBazaar was able to identify 30 sections in this file using oledump:

Section IDSection sizeSection name
1624 bytesPROJECT
2182 bytesPROJECTwm
31143 bytesVBA/ThisDocument
44994 bytesVBA/_VBA_PROJECT
54606 bytesVBA/__SRP_0
6624 bytesVBA/__SRP_1
7348 bytesVBA/__SRP_10
8106 bytesVBA/__SRP_11
9293 bytesVBA/__SRP_2
10156 bytesVBA/__SRP_3
111227 bytesVBA/__SRP_4
12284 bytesVBA/__SRP_5
131031 bytesVBA/__SRP_6
14396 bytesVBA/__SRP_7
151141 bytesVBA/__SRP_8
16348 bytesVBA/__SRP_9
171756 bytesVBA/__SRP_a
18426 bytesVBA/__SRP_b
192475 bytesVBA/__SRP_c
20334 bytesVBA/__SRP_d
212110 bytesVBA/__SRP_e
22390 bytesVBA/__SRP_f
238972 bytesVBA/a0tCNJ
246472 bytesVBA/aMWzJ4
2511491 bytesVBA/aMk6ZR
264255 bytesVBA/aTcfI
276737 bytesVBA/aYk3QB
284960 bytesVBA/axOFTu
291325 bytesVBA/azyEN
30782 bytesVBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecAutoOpenRuns when the Word document is opened
SuspiciousEnvironMay read system environment variables
SuspiciousOpenMay open a file
SuspiciousOutputMay write to a file (if combined with Open)
SuspiciousFileCopyMay copy a file
SuspiciousrunMay run an executable file or a system command
SuspiciousCreateObjectMay create an OLE object
SuspiciousChrWMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
526
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
da2125cee0845ec929437ed4b9f0fdb31ef10bee
Verdict:
No threats detected
Analysis date:
2024-11-16 12:56:35 UTC
Tags:
macros macros-on-open
Link:
https://app.any.run/tasks/b8a2fc6a-d51b-4a61-82e5-4d6ef7241427

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Legit
File type:
application/vnd.ms-excel
Has a screenshot:
False
Contains macros:
False
Detection(s):
TwinWave.EvilDoc.CROAnemone.20210607.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.MSHTA.REV.200317.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.MSHTA.REV.210901.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.ICEDIDOGORiginalGangsterCROMethodsM1.20200923.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.ShellSlicerR3CONF1GUR3D.M2.202000318.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.TalkShowHost.20210426.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6738bdaa4ca0f9db40c4a176
Tags:
icedid office macro virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Using the Windows Management Instrumentation requests
Result
Verdict:
Malicious
File Type:
Legacy Office File
Link:
https://app.docguard.net/77fdfc5339e10e1511f87bdd27f94463786381ef30d01fc9efc01c1a0dab0a85/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
macros macros-on-open masquerade
Link:
https://www.filescan.io/uploads/673896de2052bf85db59176e/reports/590c6950-42d6-4aa5-911e-84d8e0c44cb8/overview
Verdict:
Malicious
Labled as:
VBA:Amphitryon.1773
Link:
https://www.hybrid-analysis.com/sample/77fdfc5339e10e1511f87bdd27f94463786381ef30d01fc9efc01c1a0dab0a85
Label:
Malicious
Suspicious Score:
9.7/10
Score Malicious:
98%
Score Benign:
2%
Link:
https://www.malware.ai/gui/files/?id=dbcd47a2-3a87-44ea-bbc5-ed665fcaf811
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1556937
Signature
Antivirus / Scanner detection for submitted sample
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Uses Windows timers to delay execution
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
OFFICE
Link:
https://malprob.io/report/77fdfc5339e10e1511f87bdd27f94463786381ef30d01fc9efc01c1a0dab0a85
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/77fdfc5339e10e1511f87bdd27f94463786381ef30d01fc9efc01c1a0dab0a85/
Threat name:
Script-Macro.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2024-11-16 04:19:33 UTC
File Type:
Binary (Archive)
Extracted files:
38
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o767yuzz4ehbkepypposp6kemn4ghappgdib7sppyaobudnlbkcq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery macro macro_on_action
Link:
https://tria.ge/reports/241116-s5w2msxrft/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
System Location Discovery: System Language Discovery
Verdict:
Malicious
Tags:
trojan TA505
YARA:
TA505_Maldoc_21Nov_2
Link:
https://app.threat.zone/submission/b199d12d-9489-4c3f-a2ed-47fbe0e0732e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/77fdfc5339e10e1511f87bdd27f94463786381ef30d01fc9efc01c1a0dab0a85

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:TA505_Maldoc_21Nov_2
Create hunting rule
Author:Arkbird_SOLG
Description:invitation (1).xls
Reference:https://twitter.com/58_158_177_102/status/1197432303057637377
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments