MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7af153ac40fe111dc312c90544b1e6c2c7ffbd5cc116eea719cfd52d6027e35a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 9
Maldoc score: 17
| SHA256 hash: | 7af153ac40fe111dc312c90544b1e6c2c7ffbd5cc116eea719cfd52d6027e35a |
|---|---|
| SHA3-384 hash: | e7ac58c062046184554742c6d166f0b56d858290a9a667ead905f5e57bbf3b61fbe56a713b057a2f19232ee03d106b80 |
| SHA1 hash: | daac61b7712691931f8929856f7344b6d09922e8 |
| MD5 hash: | 1faf78a02d11127b48f9b4edec51f318 |
| humanhash: | single-social-five-spaghetti |
| File name: | 1faf78a02d11127b48f9b4edec51f318.xlsm |
| Download: | download sample |
| File size: | 30'319 bytes |
| First seen: | 2022-03-22 19:03:34 UTC |
| Last seen: | Never |
| File type: |  xlsm |
| MIME type: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
| ssdeep | 384:YkAYJPRowLSb4mF+xvQ9J4NFcWxOJBuQhSpKxPp4nR/L/AN9QR+tB+JB7RY8r+rT:YG9AGvyJciu3cW/bR0Itrc2z4F |
| TLSH | T1C1D2E19AD3125C1DD77700FCC46A0A91C15340E84605D97B306B3BAC1A87B92F3E67EB |
| Reporter |  abuse_ch |
| Tags: | xlsm |
Office OLE Information
This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.
OLE id
| Maldoc score: 17 |
OLE dump
MalwareBazaar was able to identify 10 sections in this file using oledump:
| Section ID | Section size | Section name |
|---|---|---|
| A1 | 374 bytes | PROJECT |
| A2 | 41 bytes | PROJECTwm |
| A3 | 21238 bytes | VBA/ThisWorkbook |
| A4 | 3237 bytes | VBA/_VBA_PROJECT |
| A5 | 11051 bytes | VBA/__SRP_0 |
| A6 | 277 bytes | VBA/__SRP_1 |
| A7 | 406 bytes | VBA/__SRP_4 |
| A8 | 22481 bytes | VBA/__SRP_5 |
| A9 | 478 bytes | VBA/dir |
OLE vba
MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:
| Type | Keyword | Description |
|---|---|---|
| AutoExec | Workbook_BeforeClose | Runs when the Excel Workbook is closed |
| Suspicious | copyfile | May copy a file |
| Suspicious | Create | May execute file or a system command through WMI |
| Suspicious | GetObject | May get an OLE object with a running instance |
| Suspicious | Chr | May attempt to obfuscate specific strings (use option --deobf to deobfuscate) |
| Suspicious | StrReverse | May attempt to obfuscate specific strings (use option --deobf to deobfuscate) |
| Suspicious | Xor | May attempt to obfuscate specific strings (use option --deobf to deobfuscate) |
| Suspicious | Hex Strings | Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all) |
| Suspicious | Base64 Strings | Base64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all) |
Intelligence
File Origin
# of uploads :
1
# of downloads :
291
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
main.xlsm
Verdict:
Malicious activity
Analysis date:
2022-03-21 20:45:41 UTC
Tags:
macros
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/vnd.ms-excel.sheet.macroEnabled.12
Has a screenshot:
False
Contains macros:
True
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Sending a custom TCP request
Creating a window
Сreating synchronization primitives
Searching for the window
Launching a process
Changing an executable file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
Malicious
File Type:
Excel File with Macro
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
macros macros-on-close
Label:
Malicious
Suspicious Score:
9.9/10
Score Malicious:
1%
Score Benign:
0%
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Behaviour
Behavior Graph:
n/a
Threat name:
Script.Trojan.Heuristic
Status:
Malicious
First seen:
2022-03-22 09:55:38 UTC
File Type:
Document
Extracted files:
23
AV detection:
8 of 26 (30.77%)
Threat level:
2/5
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
xlsm 7af153ac40fe111dc312c90544b1e6c2c7ffbd5cc116eea719cfd52d6027e35a
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.