MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8056c874a9bc6c2204ab4ea45a6f0ef4f2de0302e367695fdfd3599e4509df55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8056c874a9bc6c2204ab4ea45a6f0ef4f2de0302e367695fdfd3599e4509df55
SHA3-384 hash:	47d16673c756f7ea55eb1673757073acb22269aa33b598b4ab63c5d17523215273f930ca19b6a4bd25a0de271721a06c
SHA1 hash:	8d9f55c90db961ea66993fd03e148b0dc9bcec5b
MD5 hash:	e7bc410788af86fe5e41695dd0ae308b
humanhash:	delaware-mike-november-august
File name:	Tax_Documents.docx
Download:	download sample
Signature	AveMariaRAT Alert Create hunting rule
File size:	297'778 bytes
First seen:	2022-04-06 17:17:04 UTC
Last seen:	Never
File type:	doc
MIME type:	application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep	6144:M9z4Tkn5m8YZ06AgdkaG1BMKUwWVwlNIJ+o/xCxzxkxht:M9z4Tkn5UFdiPUwWVwlN05clOht
TLSH	T10D540224F039F489CA9F113DC1058EF7B24B0250B6C1A456B911D7AF6652EAF478F2FA
Reporter	pr0xylife
Tags:	AveMariaRAT doc WarzoneRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

292

Origin country :

n/a

Vendor Threat Intelligence

BitDam Malicious

Verdict:

Malicious

File type:

application/msword

Has a screenshot:

False

Contains macros:

False

ClamAV Detected

Detection(s):

TwinWave.EvilDoc.DOCXRSTRGOOD.WIN32_PROCESS.210419.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.MSHTAHEYAAAAHEYAAAA.20210714.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a window

Searching for synchronization primitives

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Creating a process with a hidden window

Launching a tool to kill processes

Bypassing of proactive protection methods using Windows Management Instrumentation (WMI)

Creating a process from a recently created file

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

OOXML Word File with Embedding Objects

Link:

https://app.docguard.net/8056c874a9bc6c2204ab4ea45a6f0ef4f2de0302e367695fdfd3599e4509df55/results/dashboard

Document image

Image:

Download PNG

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

alien macros-on-open stripped

Link:

https://www.filescan.io/uploads/624dcb19db9ca5cf842e9998/reports/9a97c09d-a186-455a-a3dd-385402d3b93e/overview

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

8.2/10

Score Malicious:

83%

Score Benign:

17%

Link:

https://www.malware.ai/gui/files/?id=66571af3-21e1-4ea4-8b00-abd9108c9785

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/8056c874a9bc6c2204ab4ea45a6f0ef4f2de0302e367695fdfd3599e4509df55

Details

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

Macro with File System Write

Detected macro logic that can write data to the file system.

Macro Execution Coercion

Detected a document that appears to social engineer the user into activating embedded logic.

Macro Contains Suspicious String

Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...

InQuest Machine Learning

An InQuest machine-learning model classified this macro as potentially malicious.

Document With No Content

Document contains little or no semantic information.

Joe Sandbox unknown

Result

Threat name:

Unknown

Detection:

unknown

Classification:

n/a

Score:

0 / 100

Link:

https://www.joesandbox.com/analysis/970801

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8056c874a9bc6c2204ab4ea45a6f0ef4f2de0302e367695fdfd3599e4509df55/

ReversingLabs TitaniumCloud Document-Office.Trojan.Alien

Threat name:

Document-Office.Trojan.Alien

Alert

Create hunting rule

Status:

Malicious

First seen:

2022-04-04 21:45:53 UTC

File Type:

Document

Extracted files:

128

AV detection:

12 of 41 (29.27%)

Threat level:

  5/5

Hatching Triage warzonerat

Result

Malware family:

warzonerat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:asyncrat family:warzonerat infostealer rat

Link:

https://tria.ge/reports/220406-vtq3csfgd5/

Behaviour

Checks processor information in registry

Creates scheduled task(s)

Enumerates system info in registry

Kills process with taskkill

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Modifies registry class

Modifies system certificate store

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Office loads VBA resources, possible macro or embedded object present

Enumerates physical storage devices

Program crash

Drops file in System32 directory

Suspicious use of SetThreadContext

Checks computer location settings

Loads dropped DLL

Downloads MZ/PE file

Executes dropped EXE

Async RAT payload

Warzone RAT Payload

AsyncRat

Process spawned unexpected child process

WarzoneRat, AveMaria

Malware Config

C2 Extraction:

mubbibun.duckdns.org:999

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.