MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ea9628a6d531b6d190d3333aadf636aae7b87de423ab6975a92dabcf7fbf5f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Maldoc score: 1764

Intelligence 10 IOCs YARA 7 File information Comments

SHA256 hash:	7ea9628a6d531b6d190d3333aadf636aae7b87de423ab6975a92dabcf7fbf5f8
SHA3-384 hash:	6442c804df349776d2b4ebe13b1198fea9a3c88e0caa419ec907cc340ca932821534acede9aae08c0f54ac0e2571117a
SHA1 hash:	4605fc8647d1027234894d3b72f7eb4aabb00590
MD5 hash:	ca92ffaa066de4a811e0ae179c1adbc2
humanhash:	lemon-item-stream-pip
File name:	R.E-LOECHES CAMBIO DE VALVULAS PTK30.xlsm
Download:	download sample
File size:	849'239 bytes
First seen:	2026-08-05 12:53:44 UTC
Last seen:	Never
File type:	xlsm
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	12288:gLylMDadzn89+xamtgnZ+xTru0nTlOvchowFQcCbPYLuNTiCw317rvglDVCobOA2:guJ5nXMZi/n5OvchvQpJGCwvc2pBz
TLSH	T1DC05122DF726899DCF2A943CC00803D79D0E595784E1A85E1E94BB443B5A4FF8F8E4AD
TrID	42.4% (.XLAM) Excel Macro-enabled Open XML add-in (83500/1/13) 29.2% (.XLSM) Excel Microsoft Office Open XML Format document (with Macro) (57500/1/12) 17.3% (.XLSX) Excel Microsoft Office Open XML Format document (34000/1/7) 8.9% (.ZIP) Open Packaging Conventions container (17500/1/4) 2.0% (.ZIP) ZIP compressed archive (4000/1)
Magika	xlsx
Reporter	abuse_ch
Tags:	xlsm

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 1764

File Format is MS Excel 2007+

Container Format is OpenXML

Office document contains VBA Macros

Office document contains 4 external relationships (see links below)

Relationship	External Link
hyperlink	https://maximoapp.grupoclh.com/
hyperlink	http://2.139.153.3:7710/meaweb/os/
hyperlink	https://pmaximoapp.grupoclh.com/
hyperlink	https://dmaximoapp.grupoclh.com/

Embedded Images

MalwareBazaar found the following images embedded in this file:

MD5 hash	dc.creator	# of relations
b6fee0c580077cafa778aac5283b303d	Bruno Portaluri	None

OLE dump

MalwareBazaar was able to identify 135 sections in this file using oledump:

Section ID	Section size	Section name
A1	2896 bytes	PROJECT
A2	30 bytes	PROJECTlk
A3	1328 bytes	PROJECTwm
A4	12812 bytes	VBA/ConvNodeToSheet
A5	12577 bytes	VBA/ConvSheetToNode
A6	998 bytes	VBA/Hoja1
A7	64528 bytes	VBA/Main
A8	1000 bytes	VBA/MxAttrCfg
A9	1001 bytes	VBA/MxConfig
A10	1055 bytes	VBA/MxConfigH
A11	1004 bytes	VBA/MxLoaderOS
A12	25175 bytes	VBA/MxMifService
A13	17163 bytes	VBA/MxNode
A14	9603 bytes	VBA/MxNodeAttr
A15	26928 bytes	VBA/MxSheet
A16	998 bytes	VBA/MxTemplates
A17	13803 bytes	VBA/MxUtils
A18	16465 bytes	VBA/MxlConfig
A19	6146 bytes	VBA/MxlLogger
A20	1914 bytes	VBA/MxlObjAttr
A21	22374 bytes	VBA/MxlParseJson
A22	13239 bytes	VBA/MxlParseXml
A23	8408 bytes	VBA/MxlPropFile
A24	8554 bytes	VBA/Reg
A25	998 bytes	VBA/Sheet1
A26	999 bytes	VBA/Sheet16
A27	999 bytes	VBA/Sheet19
A28	998 bytes	VBA/Sheet2
A29	999 bytes	VBA/Sheet20
A30	998 bytes	VBA/Sheet3
A31	999 bytes	VBA/Sheet31
A32	998 bytes	VBA/Sheet4
A33	1007 bytes	VBA/ThisWorkbook
A34	24311 bytes	VBA/_VBA_PROJECT
A35	10701 bytes	VBA/__SRP_0
A36	2895 bytes	VBA/__SRP_1
A37	3751 bytes	VBA/__SRP_2
A38	2056 bytes	VBA/__SRP_3
A39	2883 bytes	VBA/__SRP_4
A40	2112 bytes	VBA/__SRP_5
A41	1039 bytes	VBA/__SRP_6
A42	492 bytes	VBA/__SRP_7
A43	1483 bytes	VBA/__SRP_8
A44	602 bytes	VBA/__SRP_9
A45	3586 bytes	VBA/__SRP_a
A46	1914 bytes	VBA/__SRP_b
A47	1279 bytes	VBA/__SRP_c
A48	656 bytes	VBA/__SRP_d
A49	4472 bytes	VBA/__SRP_e
A50	2132 bytes	VBA/__SRP_f
A51	2894 bytes	VBA/dir
A52	5165 bytes	VBA/frmAbout
A53	1878 bytes	VBA/frmConnOk
A54	8604 bytes	VBA/frmError
A55	9841 bytes	VBA/frmExport
A56	3479 bytes	VBA/frmProgress
A57	5130 bytes	VBA/frmProgressQuery
A58	5334 bytes	VBA/frmProgressSynch
A59	2166 bytes	VBA/frmPwdInput
A60	3140 bytes	VBA/frmRegWarn
A61	2669 bytes	VBA/frmResult
A62	2494 bytes	VBA/frmResultQuery
A63	6913 bytes	VBA/frmTemplates
A64	31973 bytes	VBA/frmWizard
A65	97 bytes	frmAbout/CompObj
A66	298 bytes	frmAbout/VBFrame
A67	559 bytes	frmAbout/f
A68	9409 bytes	frmAbout/o
A69	97 bytes	frmConnOk/CompObj
A70	305 bytes	frmConnOk/VBFrame
A71	447 bytes	frmConnOk/f
A72	412 bytes	frmConnOk/o
A73	97 bytes	frmError/CompObj
A74	292 bytes	frmError/VBFrame
A75	535 bytes	frmError/f
A76	524 bytes	frmError/o
A77	97 bytes	frmExport/CompObj
A78	304 bytes	frmExport/VBFrame
A79	783 bytes	frmExport/f
A80	948 bytes	frmExport/o
A81	97 bytes	frmProgress/CompObj
A82	298 bytes	frmProgress/VBFrame
A83	379 bytes	frmProgress/f
A84	112 bytes	frmProgress/i04/CompObj
A85	108 bytes	frmProgress/i04/f
A86	112 bytes	frmProgress/i04/i12/CompObj
A87	60 bytes	frmProgress/i04/i12/f
A88	0 bytes	frmProgress/i04/i12/o
A89	0 bytes	frmProgress/i04/o
A90	292 bytes	frmProgress/o
A91	97 bytes	frmProgressQuery/CompObj
A92	299 bytes	frmProgressQuery/VBFrame
A93	359 bytes	frmProgressQuery/f
A94	112 bytes	frmProgressQuery/i21/CompObj
A95	108 bytes	frmProgressQuery/i21/f
A96	112 bytes	frmProgressQuery/i21/i22/CompObj
A97	60 bytes	frmProgressQuery/i21/i22/f
A98	0 bytes	frmProgressQuery/i21/i22/o
A99	0 bytes	frmProgressQuery/i21/o
A100	292 bytes	frmProgressQuery/o
A101	97 bytes	frmProgressSynch/CompObj
A102	334 bytes	frmProgressSynch/VBFrame
A103	1239 bytes	frmProgressSynch/f
A104	112 bytes	frmProgressSynch/i04/CompObj
A105	108 bytes	frmProgressSynch/i04/f
A106	112 bytes	frmProgressSynch/i04/i05/CompObj
A107	60 bytes	frmProgressSynch/i04/i05/f
A108	0 bytes	frmProgressSynch/i04/i05/o
A109	0 bytes	frmProgressSynch/i04/o
A110	1432 bytes	frmProgressSynch/o
A111	97 bytes	frmPwdInput/CompObj
A112	293 bytes	frmPwdInput/VBFrame
A113	375 bytes	frmPwdInput/f
A114	336 bytes	frmPwdInput/o
A115	97 bytes	frmRegWarn/CompObj
A116	308 bytes	frmRegWarn/VBFrame
A117	223 bytes	frmRegWarn/f
A118	288 bytes	frmRegWarn/o
A119	97 bytes	frmResult/CompObj
A120	296 bytes	frmResult/VBFrame
A121	711 bytes	frmResult/f
A122	752 bytes	frmResult/o
A123	97 bytes	frmResultQuery/CompObj
A124	302 bytes	frmResultQuery/VBFrame
A125	615 bytes	frmResultQuery/f
A126	656 bytes	frmResultQuery/o
A127	97 bytes	frmTemplates/CompObj
A128	304 bytes	frmTemplates/VBFrame
A129	311 bytes	frmTemplates/f
A130	284 bytes	frmTemplates/o
A131	97 bytes	frmWizard/CompObj
A132	299 bytes	frmWizard/VBFrame
A133	895 bytes	frmWizard/f
A134	1292 bytes	frmWizard/o

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	cmdOk_Click	Runs when the file is opened and ActiveXobjects trigger events
AutoExec	txtSearch_Change	Runs when the file is opened and ActiveXobjects trigger events
IOC	https://bportaluri.com/mxloader-registration	URL
IOC	http://maximohost.com/	URL
IOC	https://bportaluri.com/2021/04/mxloader-rest-query-where.html	URL
IOC	https://www.ibm.com/developerworks/community/forums/html/top4526-8804-e2486565ff	URL
IOC	https://bportaluri.com/2017/03/load-failure-codes-in-maximo.html	URL
IOC	http://www.w3.org/2001/XMLSchema-instance	URL
IOC	https://en.wikipedia.org/wiki/Comma-separated_values	URL
IOC	http://www.ibm.com/maximo	URL
IOC	http://schemas.xmlsoap.org/soap/envelope/	URL
IOC	http://www.normanbauer.com/2011/02/10/certificate-problems-with-vbscript-and-xml-http-calls/	URL
IOC	http://www.logikdev.com/2010/07/07/use-serverxmlhttp-through-proxy/	URL
IOC	https://moremaximo.com/discussion/autoscript-migration-with-mxloader-in-mas-instance	URL
IOC	https://www.json.org/json-en.htmlParseValue	URL
IOC	https://github.com/VBA-tools/VBA-JSON/blob/master/JsonConverter.bas	URL
IOC	http://www.vbaccelerator.com/home/VB/Code/Techniques/RunTime_Debug_Tracing/VB6_Tracer_Utility_zip_cStringBuilder_cls.asp	URL
IOC	https://github.com/VBA-tools/VBA-JSON/pull/82	URL
IOC	https://bportaluri.com/mxloader	URL
IOC	https://bportaluri.com/mxloader/mxloader-changelog	URL
IOC	https://bportaluri.c399	URL
IOC	https://moremaximo.com/communities/commu-7d9b-4536-91d3-92892efefd61	URL
IOC	https://stackoverflow.com/questions/17359835/what-is-the-difference-between-text-value-and-value2	URL
IOC	https://www.ibm.com/developerworks/community/forums/html/top4153-8631-4484bf4b742a	URL
IOC	https://www.motobit.com/tips/detpg_Base64/	URL
IOC	http://Motobit.cz	URL
IOC	https://stackoverflow.com/questions/33734706/excels-fullname-property-with-onedrive	URL
IOC	https://www.ibm.com/developerworks/community/forums/html/top48a1-b698-d1ba2f6262f-83aa-dc54e69955bd	URL
IOC	https://gist.github.com/steve-jansen/7589478	URLcode and P-code are different, this may havebeen used to hide malicious code
Suspicious	Environ	May read system environment variables
Suspicious	environment	May read system environment variables
Suspicious	Open	May open a file
Suspicious	Write	May write to a file (if combined with Open)
Suspicious	Put	May write to a file (if combined with Open)
Suspicious	Output	May write to a file (if combined with Open)
Suspicious	binary	May read or write a binary file (if combinedwith Open)
Suspicious	FileCopy	May copy a file
Suspicious	Kill	May delete a file
Suspicious	ADODB.Stream	May create a text file
Suspicious	WriteText	May create a text file
Suspicious	SaveToFile	May create a text file
Suspicious	Run	May run an executable file or a systemcommand
Suspicious	create	May execute file or a system command throughWMI
Suspicious	MkDir	May create a directory
Suspicious	CreateObject	May create an OLE object
Suspicious	Windows	May enumerate application windows (ifcombined with Shell.Application object)
Suspicious	User-Agent	May download files from the Internet
Suspicious	Chr	May attempt to obfuscate specific strings(use option --deobf to deobfuscate)
Suspicious	ChrW	May attempt to obfuscate specific strings(use option --deobf to deobfuscate)
Suspicious	StrReverse	May attempt to obfuscate specific strings(use option --deobf to deobfuscate)
Suspicious	VBProject	May attempt to modify the VBA code (self-modification)
Suspicious	VBComponents	May attempt to modify the VBA code (self-modification)
Suspicious	System	May run an executable file or a systemcommand on a Mac (if combined withlibc.dylib)
Suspicious	Hex Strings	Hex-encoded strings were detected, may beused to obfuscate strings (option --decode tosee all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may beused to obfuscate strings (option --decode tosee all)

Intelligence

File Origin

# of uploads :

# of downloads :

158

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/54e7e74d-7c86-4fef-809a-06ab32ab1242/

Malware family:

n/a

ID:

File name:

xlsm

Verdict:

No threats detected

Analysis date:

2026-08-05 13:15:27 UTC

Tags:

macros

Link:

https://app.any.run/tasks/598f21d0-b93a-4dc1-9b87-332a443d8fcf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Legit

File type:

text/xml

Has a screenshot:

False

Contains macros:

False

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/78935/

Detection(s):

TwinWave.EvilDoc.XL4MDottedQuadDancingInHeaven.20210421.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Launching a service

Searching for synchronization primitives

Result

Verdict:

Malicious

File Type:

Excel File with Macro

Link:

https://app.docguard.net/7ea9628a6d531b6d190d3333aadf636aae7b87de423ab6975a92dabcf7fbf5f8/results/dashboard

Behaviour

BlacklistAPI detected

Document image

Image:

Download PNG

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive macros macros-on-event macros-on-open obfuscated

Link:

https://www.filescan.io/uploads/6a73328f9132c7eb3cbbea2d/reports/d31eed5d-c946-4dc4-ba05-6534d960d5e5/overview

Verdict:

Malicious

Labled as:

Msoffice/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/7ea9628a6d531b6d190d3333aadf636aae7b87de423ab6975a92dabcf7fbf5f8

Label:

Benign

Suspicious Score:

/10

Score Malicious:

Score Benign:

Link:

https://www.malware.ai/gui/files/?id=c846fe87-adab-46e9-8a49-b91f58081977

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.expl.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1952720

Signature

Antivirus detection for URL or domain

Document contains an embedded VBA macro which might access itself as a file (possible anti-VM)

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Document contains an embedded VBA with many string operations indicating source code obfuscation

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

OFFICE

Link:

https://malprob.io/report/7ea9628a6d531b6d190d3333aadf636aae7b87de423ab6975a92dabcf7fbf5f8

Verdict:

Malware

YARA:

3 match(es)

Tags:

ADODB.Stream ATT&CK T1564.007 Blacklist VBA DeObfuscated Highly Suspicious Document Malicious Malicious Document MSXml2.DOMDocument Obfuscated Office Document Scripting.Dictionary Scripting.FileSystemObject T1027 T1059.005 VBA Stomping VBScript

Link:

https://app.malva.re/file/ca92ffaa066de4a811e0ae179c1adbc2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7ea9628a6d531b6d190d3333aadf636aae7b87de423ab6975a92dabcf7fbf5f8/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=p2uwfctnkmnw2gingmz2vx3dnkxhxb66ii5lnf22slnlz5736x4a._file

Result

Malware family:

n/a

Score:

8/10

Tags:

macro

Link:

https://tria.ge/reports/260805-p5fg4sxhpf/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	vbaproject_bin Create hunting rule
Author:	CD_R0M_
Description:	{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/78935/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample