MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9111a140dc44902f3cbed5acba3ed11245c1cd96c7145b8a2a52a1d8118f97c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9111a140dc44902f3cbed5acba3ed11245c1cd96c7145b8a2a52a1d8118f97c7
SHA3-384 hash:	31a1277d2597095f2a8a8db201105185674ffb1e8f8373f707b10ecbdf017764794e8c46126e51914cc780a89c936e87
SHA1 hash:	ea15aa11a50ba332618282e1d190670ff8dfb799
MD5 hash:	ef232451d397191cc2048e7f3c94b7d6
humanhash:	fish-romeo-texas-south
File name:	tax_6253026.xlsb
Download:	download sample
Signature	Dridex Alert Create hunting rule
File size:	70'287 bytes
First seen:	2021-11-25 12:47:11 UTC
Last seen:	Never
File type:	xlsx
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	1536:UWK0PqrE3gpMokPF58Ik4kosQFVvSuMtBzatKVXxDOM8vVex+cLuYgdN:V0EwFkd58IXkOFVvMtBz7DOM48x+cLu5
TLSH	T1E563F212CB5FF850C2F740BC81599ED1750B573CAD92F21F39B0A708D9A678BA74436A
Reporter	proxylife
Tags:	Dridex xlsx

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

196

Origin country :

n/a

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

tax_6253026.xlsb

Verdict:

No threats detected

Analysis date:

2021-11-25 13:01:49 UTC

Tags:

macros40

Link:

https://app.any.run/tasks/aa62298a-8320-400d-a510-2efa7977c0ef

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

BitDam Malicious

Verdict:

Malicious

File type:

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

Has a screenshot:

False

Contains macros:

False

CAPE Sandbox

Gathering data

ClamAV Detected

Detection(s):

TwinWave.EvilDoc.XL4MQakyEsqHomeComing.20210426.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.XL4MDridexYourStringShilouette.20211102.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.XL4MDridexRunningDownTheDream.20211115.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.DridexAndTheFuriousFiveMessage.20211124.UNOFFICIAL

Alert

Create hunting rule

securiteinfo.com.xls4.icedid.42146.5256.5371.UNOFFICIAL

Alert

Create hunting rule

securiteinfo.com.xls4.icedid.42146.23809.575.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

DNS request

Creating a window

Сreating synchronization primitives

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

OOXML Excel File with Excel4Macro

Link:

https://app.docguard.net/9111a140dc44902f3cbed5acba3ed11245c1cd96c7145b8a2a52a1d8118f97c7/results/dashboard

Document image

Image:

Download PNG

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

mshta

Link:

https://www.filescan.io/uploads/619f8606f36138de3f3c5ac4/reports/2963aa38-fef9-47cb-ba06-83dcf10beb5b/overview

Joe Sandbox Dridex Downloader

Result

Threat name:

Dridex Downloader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/896076

Signature

Contains functionality to create processes via WMI

Creates and opens a fake document (probably a fake document to hide exploiting)

Creates processes via WMI

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Multi AV Scanner detection for domain / URL

Sigma detected: Microsoft Office Product Spawning Windows Shell

Yara detected Dridex Downloader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9111a140dc44902f3cbed5acba3ed11245c1cd96c7145b8a2a52a1d8118f97c7/

ReversingLabs TitaniumCloud Script-WScript.Malware.XBAgent

Threat name:

Script-WScript.Malware.XBAgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2021-11-24 14:22:27 UTC

AV detection:

4 of 45 (8.89%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sei2cqg4isic6pf62wwlupwrcjc4dtmwy4kfxcrkkkq5qemps7dq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

macro xlm

Link:

https://tria.ge/reports/211125-p1slwaaeg4/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9111a140dc44902f3cbed5acba3ed11245c1cd96c7145b8a2a52a1d8118f97c7

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/209367/