MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8edeefa8a8c07604e753db1011e4389d057560cfb57b307e12587cdb17a13606. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 12

Maldoc score: 52

Intelligence 12 IOCs YARA 7 File information Comments

SHA256 hash:	8edeefa8a8c07604e753db1011e4389d057560cfb57b307e12587cdb17a13606
SHA3-384 hash:	993fb3015cb0d1ae01333c9b8ca539ea575cf178fc6a5e92c812ace6ba2c9cbe78a989ba224c5854d30f621a362c0282
SHA1 hash:	99a182f4760ee5a995f65d9bd0c4158a009b41d5
MD5 hash:	47a134bdca513e151fad9df8994813f2
humanhash:	august-dakota-hotel-johnny
File name:	POM-8501.doc
Download:	download sample
File size:	120'363 bytes
First seen:	2023-01-19 07:47:22 UTC
Last seen:	Never
File type:	doc
MIME type:	application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep	3072:lpR19u9z+2405vybL/VCMdRRpHniv13m3C:lzuhdv0VJJiv12S
TLSH	T151C30261C91981CDFDB3F034348410FEBAE59844C99CA8BF826659B81D42ACCD76DBB7
TrID	53.0% (.DOCM) Word Microsoft Office Open XML Format document (with Macro) (52000/1/9) 23.9% (.DOCX) Word Microsoft Office Open XML Format document (23500/1/4) 17.8% (.ZIP) Open Packaging Conventions container (17500/1/4) 4.0% (.ZIP) ZIP compressed archive (4000/1) 1.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	lowmal3
Tags:	doc

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 52

OLE dump

MalwareBazaar was able to identify 6 sections in this file using oledump:

Section ID	Section size	Section name
A1	365 bytes	PROJECT
A2	41 bytes	PROJECTwm
A3	39190 bytes	VBA/ThisDocument
A4	6604 bytes	VBA/_VBA_PROJECT
A5	515 bytes	VBA/dir

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	Document_Open	Runs when the Word or Publisher document is opened
AutoExec	CmdCalc_Click	Runs when the file is opened and ActiveX objects trigger events
Hex String	powershell.exe	706F7765727368656C6C2E657865202D4578656375746 96F6E506F6C69637920627970617373202D6E6F70726F 66696C65202D77696E646F777374796C6520686964646 56E202D636F6D6D616E6420284E65772D4F626A656374 E446F776E6C6F616446696C652827687474703A2F2F31
Suspicious	Net.WebClient	May download files from the Internet using
Suspicious	DownloadFile	May download files from the Internet using
Suspicious	System	May run an executable file or a system command on a Mac (if combined with
Suspicious	Hex Strings	Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
Suspicious	Environ	May read system environment variables
Suspicious	Open	May open a file
Suspicious	Put	May write to a file (if combined with Open)
Suspicious	Output	May write to a file (if combined with Open)
Suspicious	Binary	May read or write a binary file (if combined with Open)
Suspicious	FileCopy	May copy a file
Suspicious	Kill	May delete a file
Suspicious	Shell	May run an executable file or a system command
Suspicious	create	May execute file or a system command through WMI
Suspicious	Command	May run PowerShell commands
Suspicious	MkDir	May create a directory
Suspicious	CreateObject	May create an OLE object
Suspicious	GetObject	May get an OLE object with a running instance
Suspicious	Lib	May run code from a DLL
Suspicious	SendKeys	May control another application by simulating user keystrokes
Suspicious	AppActivate	May control another application by simulating user keystrokes
Suspicious	chr	May attempt to obfuscate specific strings (use option --deobf to deobfuscate)
Suspicious	Xor	May attempt to obfuscate specific strings (use option --deobf to deobfuscate) Hex) Hex) Hex) Hex)
Suspicious	Start-Process	May run an executable file or a system
Suspicious	New-Object	May create an OLE object using PowerShell

Intelligence

File Origin

# of uploads :

# of downloads :

201

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

POM-8501.doc

Verdict:

Malicious activity

Analysis date:

2023-01-19 07:47:48 UTC

Tags:

loader evasion stealer

Link:

https://app.any.run/tasks/6e676dd3-98b6-4ec0-97f9-a9173a90409c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Creating a process with a hidden window

Creating a file

Creating a process from a recently created file

Launching a process

Unauthorized injection to a recently created process

Launching a file downloaded from the Internet

Sending an HTTP GET request to an infection source

Result

Verdict:

Malicious

File Type:

Word File with Macro

Link:

https://app.docguard.net/8edeefa8a8c07604e753db1011e4389d057560cfb57b307e12587cdb17a13606/results/dashboard

Payload URLs

URL

File name

http://www.allapi.net/

vbaProject.bin

Behaviour

BlacklistAPI detected

Document image

Image:

Download PNG

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

macros macros-on-open packed powershell

Link:

https://www.filescan.io/uploads/63c8f5b4bda854045c194af0/reports/40c33104-d0f2-4806-a316-9d8f89f61fc7/overview

Label:

Malicious

Suspicious Score:

9.7/10

Score Malicious:

98%

Score Benign:

Link:

https://www.malware.ai/gui/files/?id=45b3c351-2f4a-4c6a-bd38-c8e8008203cf

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/8edeefa8a8c07604e753db1011e4389d057560cfb57b307e12587cdb17a13606

Details

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

Macro with File System Write

Detected macro logic that can write data to the file system.

Macro Contains Suspicious String

Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...

Suspicious Document Variables

Detected a macro that references a suspicious number of tersely named variables.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1154436

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large strings

Antivirus / Scanner detection for submitted sample

Bypasses PowerShell execution policy

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Document contains an embedded VBA with hexadecimal encoded strings

Document contains an embedded VBA with many string operations indicating source code obfuscation

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Document exploit detected (process start blacklist hit)

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Powershell drops PE file

Sigma detected: Powershell download and execute file

Suspicious powershell command line found

Tries to download and execute files (via powershell)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8edeefa8a8c07604e753db1011e4389d057560cfb57b307e12587cdb17a13606/

Threat name:

Script-Macro.Downloader.Encdoc

Status:

Malicious

First seen:

2023-01-19 03:07:21 UTC

File Type:

Document

Extracted files:

AV detection:

15 of 25 (60.00%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=r3po7kfiyb3ajz2t3mibdzbytucxkygpwv5ta7qslb6nwf5bgyda._file

Result

Malware family:

n/a

Score:

10/10

Tags:

collection macro spyware stealer

Link:

https://tria.ge/reports/230119-jm5fmacd5v/

Behaviour

Checks processor information in registry

Creates scheduled task(s)

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Modifies system certificate store

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Office loads VBA resources, possible macro or embedded object present

Enumerates physical storage devices

Program crash

Drops file in Windows directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Process spawned unexpected child process

Malware Config

Dropper Extraction:

http://185.246.220.65/2x2/PCqcxNVzIHq2raQ.exe

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/ea69ab43-bb25-4c5c-8772-e1547b0e7dc3

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8edeefa8a8c0/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8edeefa8a8c07604e753db1011e4389d057560cfb57b307e12587cdb17a13606

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	informational_win_ole_protected Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Identify OLE Project protection within documents.

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	pdb_YARAify Create hunting rule
Author:	@wowabiy314
Description:	PDB

Rule name:	QbotStuff Create hunting rule
Author:	anonymous

Rule name:	vbaproject_bin Create hunting rule
Author:	CD_R0M_
Description:	{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

doc 8edeefa8a8c07604e753db1011e4389d057560cfb57b307e12587cdb17a13606

(this sample)

Delivery method

Distributed via e-mail attachment

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample