MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 902d92c8b869fe25b212fe80b313b8bd7391482334a155942b6bbd96e3c2f481. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 902d92c8b869fe25b212fe80b313b8bd7391482334a155942b6bbd96e3c2f481
SHA3-384 hash: 1e3190a45d739e115e058a1b76bc56c25109ca3eef8b5550af5810537c747f8c7cdd29f8dd150db600ef8828a730ae26
SHA1 hash: ecc3171ea5720db2fd83000941fcc2d4d618bbf1
MD5 hash: 94b5dda22f81433dc9282b766bbdd336
humanhash: victor-lithium-texas-enemy
File name:SecuriteInfo.com.CL.Downloadergen87.10432.2074
Download: download sample
File size:94'720 bytes
First seen:2021-03-16 00:36:42 UTC
Last seen:Never
File type:PowerPoint file ppt
MIME type:application/vnd.ms-powerpoint
ssdeep 768:pKO78ds2ea4RUcvNGs40KuI6VVUutz6P9aHiy0+84CLNdi1GIFld:c8KYa4EkG8z6P9Miy0+KkXld
TLSH C2938419F591D91EC3581A318C8EDEF6B1247D48ADCA631B73A17B7E1E3BF249B01214
Reporter SecuriteInfoCom

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.CL.Downloadergen87.10432.2074
Verdict:
No threats detected
Analysis date:
2021-03-16 00:37:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ccda579e-0dd3-4066-be43-3c348561074f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.CL.Downloadergen87.10432.2074.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Result
Verdict:
Clean
File Type:
Legacy PowerPoint File with Macro
Link:
https://app.docguard.net/902d92c8b869fe25b212fe80b313b8bd7391482334a155942b6bbd96e3c2f481/results/dashboard
Result
Verdict:
UNKNOWN
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/640174
Signature
Document contains an embedded VBA with base64 encoded strings
Document contains an embedded VBA with hexadecimal encoded strings
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/902d92c8b869fe25b212fe80b313b8bd7391482334a155942b6bbd96e3c2f481/
Threat name:
Document-Office.Trojan.Sonbokli
Create hunting rule
Status:
Malicious
First seen:
2021-03-16 00:37:05 UTC
AV detection:
3 of 47 (6.38%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro macro_on_action xlm
Link:
https://tria.ge/reports/210316-ybd8bfr8rs/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/902d92c8b869fe25b212fe80b313b8bd7391482334a155942b6bbd96e3c2f481

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments