MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9257f61caaed4e8962b1e95bf840e68f74260198abfd6f8c23f3bbf943e46f92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Maldoc score: 39

Intelligence 11 IOCs YARA 19 File information Comments

SHA256 hash:	9257f61caaed4e8962b1e95bf840e68f74260198abfd6f8c23f3bbf943e46f92
SHA3-384 hash:	e5e7bdfa95ece64ef2c6b506611a42866d00d261faba9c164a9b1db0b333910a6d3fb06e5cb57c6e2513b64eede1d97d
SHA1 hash:	fb3b51ffb30589d40cce51ca7cde3c95d24cb6a4
MD5 hash:	de646709e3b9100ef82ef0f77da8abd4
humanhash:	pip-pizza-low-six
File name:	Foglio raccolta ordine.xlsm
Download:	download sample
File size:	550'481 bytes
First seen:	2026-10-28 14:54:02 UTC
Last seen:	2026-10-28 15:25:40 UTC
File type:	xlsm
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	12288:hc2bSoceqdizOYCEfuN8slzDtFLLbb7Ir6Q12/:C2eDeq0zdfuGsZDf3bUJ2/
TLSH	T167C4D0438D149753E46C53F8BE430EAC5E0B2B48E5867AFF15624ECF3E686661C8E42D
TrID	42.4% (.XLAM) Excel Macro-enabled Open XML add-in (83500/1/13) 29.2% (.XLSM) Excel Microsoft Office Open XML Format document (with Macro) (57500/1/12) 17.3% (.XLSX) Excel Microsoft Office Open XML Format document (34000/1/7) 8.9% (.ZIP) Open Packaging Conventions container (17500/1/4) 2.0% (.ZIP) ZIP compressed archive (4000/1)
Magika	xlsx
Reporter	abuse_ch
Tags:	xlsm

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 39

File Format is MS Excel 2007+

Container Format is OpenXML

Office document contains VBA Macros

Embedded Images

MalwareBazaar found the following images embedded in this file:

MD5 hash	dc.creator	# of relations
5d4b8fee767b70265a3dcd9942745ae5	Michele Giucastro	None

OLE dump

MalwareBazaar was able to identify 17 sections in this file using oledump:

Section ID	Section size	Section name
A1	657 bytes	PROJECT
A2	197 bytes	PROJECTwm
A3	1197 bytes	VBA/Foglio1
A4	1030 bytes	VBA/Questa_cartella_di_lavoro
A5	33896 bytes	VBA/SOFISMI_Esporta
A6	340992 bytes	VBA/SOFISMI_Motore
A7	12931 bytes	VBA/_VBA_PROJECT
A8	44791 bytes	VBA/__SRP_0
A9	1939 bytes	VBA/__SRP_1
A10	128213 bytes	VBA/__SRP_2
A11	6318 bytes	VBA/__SRP_3
A12	16530 bytes	VBA/__SRP_4
A13	1048 bytes	VBA/__SRP_5
A14	464 bytes	VBA/__SRP_6
A15	106 bytes	VBA/__SRP_7
A16	696 bytes	VBA/dir

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
IOC	pdftotext.exe	Executable file namecode and P-code are different, this may havebeen used to hide malicious code
Suspicious	Open	May open a file
Suspicious	output	May write to a file (if combined with Open)
Suspicious	Kill	May delete a file
Suspicious	ADODB.Stream	May create a text file
Suspicious	WriteText	May create a text file
Suspicious	SaveToFile	May create a text file
Suspicious	shell	May run an executable file or a systemcommand
Suspicious	WScript.Shell	May run an executable file or a systemcommand
Suspicious	Run	May run an executable file or a systemcommand
Suspicious	create	May execute file or a system command throughWMI
Suspicious	MkDir	May create a directory
Suspicious	CreateObject	May create an OLE object
Suspicious	Windows	May enumerate application windows (ifcombined with Shell.Application object)
Suspicious	Chr	May attempt to obfuscate specific strings(use option --deobf to deobfuscate)
Suspicious	ChrW	May attempt to obfuscate specific strings(use option --deobf to deobfuscate)
Suspicious	Hex Strings	Hex-encoded strings were detected, may beused to obfuscate strings (option --decode tosee all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may beused to obfuscate strings (option --decode tosee all)

Intelligence

File Origin

# of uploads :

# of downloads :

194

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

MSO

Details

Link:

https://research.acce.ciphertechsolutions.com/results/4dbcdda1-2815-4924-9821-dd2f61da4c49/

Malware family:

n/a

ID:

File name:

xlsm

Verdict:

No threats detected

Analysis date:

2026-10-28 14:55:51 UTC

Tags:

macros doc-url

Link:

https://app.any.run/tasks/6a5b6007-7cba-4477-ba39-dfbae25eac6b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Legit

File type:

application/octet-stream

Has a screenshot:

False

Contains macros:

False

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/95756/

Detection(s):

Sanesecurity.Badmacro.Doc.wsc.UNOFFICIAL

TwinWave.EvilDoc.DOCXSTRGOOD..CMD.201021.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae20c9b49621540087c29d5

Tags:

office macro micro

Result

Verdict:

Malicious

File Type:

Excel File with Macro

Link:

https://app.docguard.net/9257f61caaed4e8962b1e95bf840e68f74260198abfd6f8c23f3bbf943e46f92/results/dashboard

Behaviour

BlacklistAPI detected

Document image

Image:

Download PNG

Verdict:

Malicious

Labled as:

Msoffice/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/9257f61caaed4e8962b1e95bf840e68f74260198abfd6f8c23f3bbf943e46f92

Label:

Benign

Suspicious Score:

/10

Score Malicious:

Score Benign:

Link:

https://www.malware.ai/gui/files/?id=e50132f3-d629-49d2-9103-9b3031ced252

Verdict:

Unknown

File Type:

xlsm

Link:

https://opentip.kaspersky.com/9257f61caaed4e8962b1e95bf840e68f74260198abfd6f8c23f3bbf943e46f92/results?tab=lookup

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1994088

Signature

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with many string operations indicating source code obfuscation

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

OFFICE

Link:

https://malprob.io/report/9257f61caaed4e8962b1e95bf840e68f74260198abfd6f8c23f3bbf943e46f92

Verdict:

Malware

YARA:

3 match(es)

Tags:

ADODB.Stream Blacklist VBA COM Behavior Trace DeObfuscated Obfuscated Office Document Scripting.Dictionary SOS: 0.27 SOS: 0.28 T1027 T1059.005 VBScript

Link:

https://app.malva.re/file/de646709e3b9100ef82ef0f77da8abd4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9257f61caaed4e8962b1e95bf840e68f74260198abfd6f8c23f3bbf943e46f92/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sjl7mhfk5vhisyvr5fn7qqhgr52cmamyvp6w7dbd6o57sq7en6ja._file

Result

Malware family:

n/a

Score:

8/10

Tags:

macro

Link:

https://tria.ge/reports/261028-r91pysssdz/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.86

Link:

https://yomi.yoroi.company/submissions/9257f61caaed4e8962b1e95bf840e68f74260198abfd6f8c23f3bbf943e46f92

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	informational_win_ole_protected Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Identify OLE Project protection within documents.

Rule name:	MULTI_Malware_Unknown_ForgeAuto_4f67e0b3_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)

Rule name:	MULTI_Malware_Unknown_ForgeAuto_57b77e4a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)

Rule name:	MULTI_Malware_Unknown_ForgeAuto_e38c53ae_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)

Rule name:	TA505_Maldoc_21Nov_2 Create hunting rule
Author:	Arkbird_SOLG
Description:	invitation (1).xls
Reference:	https://twitter.com/58_158_177_102/status/1197432303057637377

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	vbaproject_bin Create hunting rule
Author:	CD_R0M_
Description:	{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	WIN_Malware_ACRStealer_ForgeAuto_1084c837_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects ACRStealer (pe, etat extrait)

Rule name:	WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Fantom (pe, etat extrait)

Rule name:	WIN_Malware_PythonStealer_ForgeAuto_b24cb5bd Create hunting rule
Author:	Marjoriefort
Description:	Detects PythonStealer (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_2ffc3572 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_5001c94c Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_7e8e91c4 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/95756/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample