🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87aef5406dbda03a138f1e239db619d949eba9cca546da5956bf3d7ae2652677. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 10


Maldoc score: 12


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87aef5406dbda03a138f1e239db619d949eba9cca546da5956bf3d7ae2652677
SHA3-384 hash: 995adfc4a782d5b31da4df71b3e6c9051a3ea8353928f4dffdc4872a1e9072b2b29562f1f549a5042463605badb5128e
SHA1 hash: d6c522ab1e635fac17331c62eb1bc338dbcb4091
MD5 hash: 809ec8b9cc10b2348578ad69779f3d0b
humanhash: summer-florida-oregon-leopard
File name:Invoice 147.xls
Download: download sample
Signature ZLoader
Create hunting rule
File size:168'960 bytes
First seen:2022-07-21 05:54:22 UTC
Last seen:2022-07-21 06:43:42 UTC
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 3072:C1k3hbdlylKsgqopeJBWhZFGkE+cLax9ZBmVqTEEk5JfF5PzRBU16g0sY:kk3hbdlylKsgqopeJBWhZFVE+Wax9wqc
TLSH T16EF3C683B70D9CE5E5A48278DF938EE05E17BC0CB6451EEB22503E1A7972CB16BF1194
TrID 58.2% (.XLS) Microsoft Excel sheet (alternate) (56500/1/4)
33.5% (.XLS) Microsoft Excel sheet (32500/1/3)
8.2% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter abuse_ch
Tags:xls ZLoader

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 12
OLE dump

MalwareBazaar was able to identify 3 sections in this file using oledump:

Section IDSection sizeSection name
14096 bytesDocumentSummaryInformation
2236 bytesSummaryInformation
3157030 bytesWorkbook
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
IOCrundll32.exeExecutable file name
SuspiciousopenMay open a file
SuspiciousShellExecuteAMay run an executable file or a system command
SuspiciousShell32May run an executable file or a system command
SuspiciousWindowsMay enumerate application windows (if combined with Shell.Application object)
SuspiciousURLDownloadToFileAMay download files from the Internet
SuspiciousXLM macroXLM macro found. It may contain malicious code

Intelligence

File Origin
# of uploads :
2
# of downloads :
372
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
File type:
application/vnd.ms-excel
Has a screenshot:
False
Contains macros:
True
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/293071/
Detection(s):
TwinWave.EvilDoc.Excel4Macro.AOHiddenStrandsUnravel.20200323.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.Excel4Macro.AOHiddenStrandsUnravel.M2.20200323.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.POWERSHELL.EXE.200327.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.RUNDLL32.EXE.200327.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.URLDOWNLOADTOFILE.200327.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.DLLREGISTERSERVER.200327.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.BITSADMIN.EXE.200327.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.URLDOWNLOADTOFILE.200415.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.SHELLEXECUTE.200416.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.RUNDLL32.EXE.200416.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.DLLREGISTERSERVER.200416.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.SHELLEXECUTE.200524.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.XL4QakyFeaturingNothingNowhere.M2.20210611.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
DNS request
Result
Verdict:
Malicious
File Type:
Legacy Excel File
Link:
https://app.docguard.net/87aef5406dbda03a138f1e239db619d949eba9cca546da5956bf3d7ae2652677/results/dashboard
Document image
Image:
Download PNG
Document image
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
macros macros-on-open rundll32
Link:
https://www.filescan.io/uploads/62d8eab08fbcdde36062475b/reports/54dfb6c3-6cf8-4f05-9662-7f73904c663c/overview
Label:
Malicious
Suspicious Score:
8.0/10
Score Malicious:
81%
Score Benign:
19%
Link:
https://www.malware.ai/gui/files/?id=abc21f3f-4b03-49f4-94f3-a7ae4239c006
Result
Threat name:
Hidden Macro 4.0
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1038368
Signature
Antivirus / Scanner detection for submitted sample
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Found abnormal large hidden Excel 4.0 Macro sheet
Found obfuscated Excel 4.0 Macro
Office document connecting to suspicious TLD
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Outdated Microsoft Office dropper detected
Performs DNS queries to domains with low reputation
Potential document exploit detected (performs DNS queries with low reputation score)
Sigma detected: Execute DLL with spoofed extension
Sigma detected: Register DLL with spoofed extension
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87aef5406dbda03a138f1e239db619d949eba9cca546da5956bf3d7ae2652677/
Threat name:
Document-Excel.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2022-07-21 05:55:06 UTC
File Type:
Document
Extracted files:
6
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q6xpkqdnxwqdue4pdyrz3nqz3fe6xkomuvdnuwkwx46xvytfez3q._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
macro xlm
Link:
https://tria.ge/reports/220721-gmfq6adfbm/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Process spawned suspicious child process
Process spawned unexpected child process
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/87aef5406dbd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/87aef5406dbda03a138f1e239db619d949eba9cca546da5956bf3d7ae2652677

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Excel_Hidden_Macro_Sheet
Create hunting rule
Rule name:SUSP_Excel4Macro_AutoOpen
Create hunting rule
Author:John Lambert @JohnLaTwC
Description:Detects Excel4 macro use with auto open / close

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/293071/

Comments