🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c065bc99b79a2485f823a5fdf862627e9e4d25fa8d12d673810ea39d56e2be2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c065bc99b79a2485f823a5fdf862627e9e4d25fa8d12d673810ea39d56e2be2
SHA3-384 hash: 0e60c1ea66d7f060bbf484a883614f5ce4ba01b7aa7bdc12e68c00550e879d477b6d8a9f40f6b466f7b51c3d3ca05bf1
SHA1 hash: ebb30fd99c2e6cbae392c337df5876759e53730d
MD5 hash: bb991dafdd848f8b335a301fc965f467
humanhash: timing-timing-princess-michigan
File name:7c065bc99b79a2485f823a5fdf862627e9e4d25fa8d12d673810ea39d56e2be2.xls
Download: download sample
File size:367'616 bytes
First seen:2025-04-07 18:10:16 UTC
Last seen:Never
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 6144:xZ+RwPONXoRjDhIcp0fDlavx+W26nAESeZT3hUrrFoAUzW4ZhUsvfmLlnhm3NBnA:nSehqrdUzWch5fKnc9BNC
TLSH T125746B3E74409F5AC46B4A72DAB6BF78D62AAE49D1C94847DAA0FBD731700E0081F477
TrID 46.5% (.XLS) Microsoft Excel sheet (alternate) (56500/1/4)
26.7% (.XLS) Microsoft Excel sheet (32500/1/3)
20.1% (.XLS) Microsoft Excel sheet (alternate) (24500/1/2)
6.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika xls
Reporter JAMESWT_WT
Tags:FrostyNeighbor xls

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecAuto_OpenRuns when the Excel Workbook is opened
Hex Stringgram cannot be6772616d2063616e6e6f74206265
Hex String run in DOS mod2072756e20696e20444f53206d6f64
Hex StringmKng6d4b6e67
Hex Stringps-for-taking-dif70732d666f722d74616b696e672d646966
Hex Stringficult-dogs-on-666963756c742d646f67732d6f6e2d
Hex Stringa-walk.jpg612d77616c6b2e6a7067
Hex StringSystemCertific53797374656d4365727469666963 e
Hex Stringtent_Types74656e745f5479706573
Hex String_rel5f72656c
Hex String4Mox344d6f78
Hex Stringook.xml.rels6f6f6b2e786d6c2e72656c7320
Hex String.xml2e786d6c
Hex StringE8zi45387a69
Hex StringharedStrings.xml6861726564537472696e67732e786d6c
Hex String_DnK5f446e4b
Hex Stringv9e76396520
Hex String.72o2e37326f
Hex StringDCi944436939
Hex StringCMC-434d432d
Hex String3V.q33562e71
Hex Stringmt-A6d742d41
Hex StringXqh58716820
Hex Stringrawing1.xm726177696e67312e786d
Hex Stringl.rels6c2e72656c73
Hex Stringorksheet6f726b7368656574
Hex StringVWe056576530
Hex StringhOF8684f4638
Hex Stringr-FO722d464f
Hex Stringostd6f737464
Hex String9B1539423135
Hex StringSnjo536e6a6f
Hex Stringstyles.xml7374796c65732e786d6c
Hex String6ZWs365a5773
Hex StringVn.y566e2e79
Hex StringPM12504d3132
Hex StringXGRr58475272
Hex StringB73b42373362
Hex StringbCY.6243592e
Hex StringgmDH676d4448
Hex String3u-H33752d48
Hex StringLXJS4c584a53
Hex StringmB3Y6d423359
Hex StringKs i4b732069
Hex StringQBKY51424b59
Hex StringHCP
Hex StringKkAa4b6b4161
Hex Stringp4kD70346b44
Hex StringMcDf4d634466
Hex Stringj 5E6a203545
Hex String4epQ34657051
Hex StringpdnI70646e49
Hex Stringxml786d6c20
Hex Stringnter6e746572
Hex StringSettings1.bin53657474696e6773312e62696e
Hex StringlD8B6c443842
Hex StringdocP646f6350
Hex StringlsPK6c73504b c
Hex Stringworkbook776f726b626f6f6b
Hex String.xmlPK2e786d6c504b
Hex Stringings.696e67732e e
Hex Stringml.relsPK6d6c2e72656c73504b
Hex Stringsheet1.7368656574312e
Hex Stringxml.relsPK786d6c2e72656c73504b
Hex String1.xml312e786d6c
Hex Stringet1.xmlPK6574312e786d6c504b
Hex StringmlPK6d6c504b
Hex StringdocProps646f6350726f7073
Hex Stringtting7474696e67
Hex StringinPK696e504b
Hex Stringpp.xmlPK70702e786d6c504b
Hex StringSoftwar536f6674776172
Hex Stringicro6963726f
Hex Stringersion657273696f6e
Hex String031930333139
Hex Stringings696e6773
Hex Stringstem.R7374656d2e52
Hex Stringunti756e7469
Hex Stringme.CompilerServices6d652e436f6d70696c65725365727669636573
Hex StringompilationRelaxation6f6d70696c6174696f6e52656c61786174696f6e
Hex StringsAttr7341747472
Hex StringRuntimeComp52756e74696d65436f6d70
Hex StringibilityAttri6962696c6974794174747269
Hex Stringbute62757465
Hex StringSyst53797374
Hex Stringem.R656d2e52
Hex Stringlection6c656374696f6e
Hex StringemblyTitleAt656d626c795469746c654174
Hex Stringibute6962757465
Hex StringAssemblyD417373656d626c7944
Hex Stringescripti6573637269707469
Hex Stringttribute7474726962757465
Hex StringAssemblyC417373656d626c7943
Hex Stringonfi6f6e6669
Hex StringrationAttribute726174696f6e417474726962757465
Hex StringAssem417373656d
Hex StringyCompanyAtt79436f6d70616e79417474
Hex Stringribute726962757465
Hex StringyProductAttr7950726f6475637441747472
Hex StringyCopy79436f7079
Hex StringrightAttribute7269676874417474726962757465
Hex StringblyTrademarkAttr626c7954726164656d61726b41747472
Hex Stringtem.Runti74656d2e52756e7469
Hex Stringme.InteropServic6d652e496e7465726f70536572766963
Hex StringComVisibleAtt436f6d56697369626c65417474
Hex StringidAttrib6964417474726962
Hex StringsemblyFileV73656d626c7946696c6556
Hex StringersionAttribu657273696f6e41747472696275
Hex Stringem.Ru656d2e5275
Hex Stringme.Versioning6d652e56657273696f6e696e67
Hex StringTarg54617267
Hex StringetFr65744672
Hex Stringamew616d6577
Hex StringorkAttribute6f726b417474726962757465
Hex StringlConvStdcall6c436f6e7653746463616c6c
Hex Stringtem.Diag74656d2e44696167
Hex Stringnostics6e6f7374696373
Hex Stringcess63657373
Hex Stringicrosof6963726f736f66
Hex Stringt.Win32742e57696e3332
Hex StringRegis5265676973
Hex StringtryKe7472794b65
Hex StringByte42797465
Hex StringRuntimeHe52756e74696d654865
Hex Stringlpers6c70657273
Hex StringRunti52756e7469
Hex StringmeFieldHandle6d654669656c6448616e646c65
Hex Stringm.Text6d2e54657874
Hex StringEncodi456e636f6469
Hex Stringget_6765745f
Hex StringGetStri47657453747269
Hex StringSyste5379737465
Hex Stringm.IO6d2e494f
Hex StringFile46696c65
Hex StringWriteA577269746541
Hex StringProce50726f6365
Hex StringssStartInfo73735374617274496e666f
Hex Stringt_Fi745f4669
Hex StringleName6c654e616d65
Hex Stringset_Argumen7365745f417267756d656e
Hex Stringset_UseSh7365745f5573655368
Hex StringellExecute656c6c45786563757465
Hex StringreateNoWind72656174654e6f57696e64
Hex Stringset_Redir7365745f5265646972
Hex StringtStandardI745374616e6461726449
Hex Stringnput6e707574
Hex Stringset_St7365745f5374
Hex StringartI61727449
Hex StringreamWriter7265616d577269746572
Hex Stringt_Standard745f5374616e64617264
Hex StringInput496e707574
Hex StringTextWri54657874577269
Hex StringiteLine6974654c696e65
Hex StringRegist526567697374
Hex StringCurr43757272
Hex StringentUs656e745573
Hex StringOpenSub4f70656e537562
Hex StringSetV53657456
Hex Stringstem.Net7374656d2e4e6574
Hex StringebRe65625265
Hex Stringquest7175657374
Hex StringHttpWebResp4874747057656252657370
Hex Stringonse6f6e7365
Hex StringMemoryStr4d656d6f7279537472
Hex StringWebR57656252
Hex Stringset_UserA7365745f5573657241
Hex Stringset_M7365745f4d
Hex Stringethod6574686f64
Hex StringResponse526573706f6e7365
Hex StringGetRe4765745265
Hex Stringsponse73706f6e7365
Hex StringsponseS73706f6e736553
Hex StringCopy436f7079
Hex StringDispo446973706f
Hex StringToAr546f4172
Hex Stringsposable73706f7361626c65
Hex Stringstem.Th7374656d2e5468
Hex Stringread72656164
Hex StringGetP47657450
Hex Stringrocess726f63657373
Hex Stringget_ProcessN6765745f50726f636573734e
Hex Stringuals75616c73
Hex StringKill4b696c6c
Hex StringCompilerGen436f6d70696c657247656e
Hex StringatedAttribu6174656441747472696275
Hex StringValueT56616c756554
Hex Stringwnldr.d776e6c64722e64
Hex Stringmscor6d73636f72
Hex Stringogra6f677261
Hex StringDwnl44776e6c
Hex Stringemen656d656e
Hex StringStaticAr5374617469634172
Hex StringStat53746174
Hex StringicArray69634172726179
Hex StringStaticArrayInitTypeS5374617469634172726179496e69745479706553697a
Hex String__StaticArrayInitTyp5f5f5374617469634172726179496e697454797065
Hex String__StaticArra5f5f53746174696341727261
Hex StringyInitTy79496e69745479
Hex StringDllUnr446c6c556e72
Hex Stringegiste656769737465
Hex Stringrver72766572
Hex StringDownloadDa446f776e6c6f61644461
Hex StringnDoc6e446f63
Hex String44A988B4CEF22A2343441393838423443454632324132
Hex String838438333834
Hex String4044C04FCA837461F70D343034344330344643413833373436314637304443
Hex StringC732BE7AE433733324245374145
Hex String76B9954CCDD3737364239393534434344443337
Hex String76E0BE7514D46796CF237364530424537353134443436373936434632
Hex String1048CC313034384343
Hex String06569EA3A730363536394541334137
Hex StringC8234B1D8A0334E433832333442314438413033333445
Hex String18FAA3138464141
Hex StringA7E448E41374534343845
Hex String93FF0F739334646304637
Hex String3E4DF3345344446
Hex StringDA6333336A6C25ECDDE64441363333333333364136433235454344444536
Hex StringEC3D04543334430
Hex StringF881DC93D246383831444339334432
Hex StringA8202AA847B8D5B413832303241413834374238443542
Hex String0E34DD9D4FD889BD3FEA3045333444443944344644383839424433464541
Hex StringFFE07B5F8464645303742354638
Hex String0A03601C8E270F9630413033363031433845323730463936
Hex String14B17024CC31344231373032344343
Hex String69DE06736394445303637
Hex StringB8FA54238464135
Hex String5AF1C9635414631433936
Hex StringF87C35E32117364155463837433335453332313137333634313535
Hex StringDFAB8F913FCD098B71F54446414238463931334643443039384237314635
Hex String9888E3938383845
Hex String060930363039
Hex StringonExcepti6f6e45786365707469
Hex StringonThrows6f6e5468726f7773
Hex StringCopyr436f707972
Hex Stringight6967687420
Hex String202432303234
Hex String78-4a5f-a5a9-62b929a37382d346135662d613561392d3632623932396134373 8
Hex String1.0.312e302e
Hex String.NET2e4e4554
Hex StringmeworkDisplayName6d65776f726b446973706c61794e616d65
Hex String Framework204672616d65776f726b
Hex StringorDllMain6f72446c6c4d61696e
Hex StringUnregisterServer556e7265676973746572536572766572
Hex Stringldr.dll6c64722e646c6c
Hex String1RuW31527557
Hex StringKdSX4b645358
Hex StringKBHd4b424864
Hex String-cI22d634932
Hex StringtWqu74577175
Hex StringcN
Hex StringpSeV70536556
Hex Stringxue378756533
Hex StringraY
Hex StringPuO050754f30
Hex Stringa5Gt61354774
Hex StringgH7jE6748376a45
Hex StringtdVl7464566c
Hex StringRo8L526f384c
Hex Stringozi36f7a6933
Hex StringoaHW6f614857
Hex String3ens33656e73
Hex String_NsQ5f4e7351
Hex StringZl4A5a6c3441
Hex StringyE-f79452d66
SuspiciousEnvironMay read system environment variables
SuspiciousEnvironmentMay read system environment variables
SuspiciousWriteMay write to a file (if combined with Open)
SuspiciousShellMay run an executable file or a system command
SuspiciousvbNormalFocusMay run an executable file or a system command
SuspiciousCreateObjectMay create an OLE object
SuspiciousChrMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousrunMay run an executable file or a system
SuspiciousWindowsMay enumerate application windows (if combined with Shell.Application object)
SuspiciousSystemMay run an executable file or a system command on a Mac (if combined with
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'342
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7c065bc99b79a2485f823a5fdf862627e9e4d25fa8d12d673810ea39d56e2be2.xls
Verdict:
Malicious activity
Analysis date:
2025-04-07 18:16:51 UTC
Tags:
auto generic loader
Link:
https://app.any.run/tasks/ac55fc9f-48a0-464e-8f79-bef2f4cb8fe4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/1129/
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67f415d4e011fe619fac28a3
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Creating a file in the %temp% directory
Loading a suspicious library
Creating a file in the %AppData% subdirectories
Searching for synchronization primitives
Launching a process
Connection attempt to an infection source by exploiting the app vulnerability
Sending an HTTP GET request to an infection source by exploiting the app vulnerability
Connection attempt to an infection source
Query of malicious DNS domain
Sending a TCP request to an infection source
Launching a process by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
Legacy Excel File with Macro
Link:
https://app.docguard.net/7c065bc99b79a2485f823a5fdf862627e9e4d25fa8d12d673810ea39d56e2be2/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin macros macros-on-open obfuscated packed reconnaissance redcap rundll32
Link:
https://www.filescan.io/uploads/67f4153b2d430c849e0b2dd3/reports/471f5ba2-7a97-4ca6-8402-94822cfe16ab/overview
Verdict:
Malicious
Labled as:
GT:VB.EmoDldr.11
Link:
https://www.hybrid-analysis.com/sample/7c065bc99b79a2485f823a5fdf862627e9e4d25fa8d12d673810ea39d56e2be2
Label:
Malicious
Suspicious Score:
10/10
Score Malicious:
1%
Score Benign:
0%
Link:
https://www.malware.ai/gui/files/?id=f154514a-039d-4a17-9daa-e20dd18637a3
Result
Threat name:
Picasso Downloader
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1658627
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates and opens a fake document (probably a fake document to hide exploiting)
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with hexadecimal encoded strings
Document contains an embedded VBA with many string operations indicating source code obfuscation
Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Document exploit detected (process start blacklist hit)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office process drops PE file
PE file contains section with special chars
PE file has nameless sections
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Suspicious Microsoft Office Child Process
System process connects to network (likely due to code injection or exploit)
Yara detected Picasso Downloader
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
OFFICE
Link:
https://malprob.io/report/7c065bc99b79a2485f823a5fdf862627e9e4d25fa8d12d673810ea39d56e2be2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7c065bc99b79a2485f823a5fdf862627e9e4d25fa8d12d673810ea39d56e2be2/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-01-22 23:17:32 UTC
File Type:
Document
Extracted files:
25
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pqdfxsm3pgreqx4chjp57brge7u6jus7vdis2zzycdvdtvlofpra._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/250407-wsnraazlx4/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Adds Run key to start application
Loads dropped DLL
Process spawned unexpected child process
Malware Family:
n/a
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/f62d0764-e247-4a8a-b034-b3c69f274164
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7c065bc99b79a2485f823a5fdf862627e9e4d25fa8d12d673810ea39d56e2be2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:XLS_STRINGS
Create hunting rule
Author:somedieyoungZZ
Description:Detect Strings targeting Bangladesh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/1129/

Comments