MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ded45c93249215db5d5c6d5136b91d837df94036a3db0384196e77f80c9207e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8ded45c93249215db5d5c6d5136b91d837df94036a3db0384196e77f80c9207e
SHA3-384 hash:	374dac3bde461a3bc748d6601ff0d29ad50682fa67566e0698c07b9ce1652ef4eeb047418d38dcbd068224b7cbe5a9b6
SHA1 hash:	d80259a4509796228cfda4b28ac9ac0854f357d7
MD5 hash:	bc7a7ebb88141e09424864772c95d48f
humanhash:	venus-fanta-nuts-hamper
File name:	RFQ.docx
Download:	download sample
Signature	VIPKeylogger Alert Create hunting rule
File size:	183'786 bytes
First seen:	2024-09-02 10:43:17 UTC
Last seen:	Never
File type:	doc
MIME type:	application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep	3072:oiY5rj1ATug+mhTZMxjcFQ9csn4qAzYjDp/shKuikycBSRjR/Vx7XU0JFk:i5r/g+qZMpcFSQzYHut4d5nk
TLSH	T1F8040230284384BACB63E435F455B02F33CFA9237B320D6527D96AA563588B7A113F5A
TrID	52.2% (.DOCX) Word Microsoft Office Open XML Format document (23500/1/4) 38.8% (.ZIP) Open Packaging Conventions container (17500/1/4) 8.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	docx
Reporter	lowmal3
Tags:	doc VIPKeylogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

3'216

Origin country :

DE

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

RFQ.docx

Verdict:

Suspicious activity

Analysis date:

2024-09-02 10:44:07 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/681209e5-89b2-4a51-9c88-5f11a83bd69c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

BitDam Legit

Verdict:

Legit

File type:

application/msword

Has a screenshot:

False

Contains macros:

False

ClamAV Detected

Detection(s):

TwinWave.EvilDoc.OkayLureDefenderWord.20220418.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.27321.XmlHeur.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.30525.XmlHeur.UNOFFICIAL

Alert

Create hunting rule

Doc.Downloader.Loda-7570590-0

Alert

Create hunting rule

TwinWave.EvilDoc.RelsPublicDottedQuadDancingInHeaven.20211202.UNOFFICIAL

Alert

Create hunting rule

MiscreantPunch.Suspicious.RemoteTemplateCall.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66d596f6a0c486d2f7940eac

Tags:

Discovery Execution Exploit Generic Infostealer Network Office Stealth Trojan

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Using the Windows Management Instrumentation requests

Creating a window

Searching for synchronization primitives

Сreating synchronization primitives

Creating a file

DNS request

Connection attempt

Sending a custom TCP request

Launching a process

Sending an HTTP GET request

Launching a file downloaded from the Internet

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Creating a process from a recently created file

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

OOXML Word File

Link:

https://app.docguard.net/8ded45c93249215db5d5c6d5136b91d837df94036a3db0384196e77f80c9207e/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

88%

Tags:

language-af masquerade

Link:

https://www.filescan.io/uploads/66d596f76e29f44ae2a63700/reports/1dd02f02-4c6c-444c-b421-9a416b188d91/overview

Hybrid Analysis CVE-2017-11882

Verdict:

Malicious

Labled as:

CVE-2017-11882

Link:

https://www.hybrid-analysis.com/sample/8ded45c93249215db5d5c6d5136b91d837df94036a3db0384196e77f80c9207e

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

9.3/10

Score Malicious:

93%

Score Benign:

7%

Link:

https://www.malware.ai/gui/files/?id=aba28445-6cfd-42ea-be57-b095a391cf9e

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/8ded45c93249215db5d5c6d5136b91d837df94036a3db0384196e77f80c9207e

Details

IPv4 Dotted Quad URL

A URL was detected referencing a direct IP address, as opposed to a domain name.

External Relationship Element

Document contains an externally hosted relationship, which fetches further content.

Joe Sandbox Snake Keylogger, VIP Keylogger

Result

Threat name:

Snake Keylogger, VIP Keylogger

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1502866

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

Antivirus detection for dropped file

Antivirus detection for URL or domain

Contains an external reference to another file

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Document exploit detected (process start blacklist hit)

Found malware configuration

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Microsoft Office drops suspicious files

Microsoft Office launches external ms-search protocol handler (WebDAV)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Office viewer loads remote template

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: Equation Editor Network Connection

Sigma detected: File Dropped By EQNEDT32EXE

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Sigma detected: Suspicious Microsoft Office Child Process

Suricata IDS alerts for network traffic

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

OFFICE

Link:

https://malprob.io/report/8ded45c93249215db5d5c6d5136b91d837df94036a3db0384196e77f80c9207e

CERT.PL MWDB cve-2017-11882-shellcode

Detection:

cve-2017-11882-shellcode

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/8ded45c93249215db5d5c6d5136b91d837df94036a3db0384196e77f80c9207e/

ReversingLabs TitaniumCloud Document-Office.Downloader.BadTemplate

Threat name:

Document-Office.Downloader.BadTemplate

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-09-02 10:44:11 UTC

File Type:

Document

Extracted files:

12

AV detection:

10 of 38 (26.32%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rxwulsjsjeqv3novy3krg24r3a357fadni63aocbs3tx7agjeb7a._file

Hatching Triage vipkeylogger

Result

Malware family:

vipkeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vipkeylogger collection credential_access discovery execution keylogger spyware stealer

Link:

https://tria.ge/reports/240902-mss7bsybrj/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Launches Equation Editor

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

outlook_office_path

outlook_win_path

Office loads VBA resources, possible macro or embedded object present

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Drops file in System32 directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Abuses OpenXML format to download file from external location

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Credentials from Password Stores: Credentials from Web Browsers

VIPKeylogger

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/66f1adaf-db30-43e3-9b81-442cf74c2600

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8ded45c93249/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8ded45c93249215db5d5c6d5136b91d837df94036a3db0384196e77f80c9207e