MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 934df0be5a13def81901b075f07f3d1f141056a406204d53f2f72ae53f583341. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 934df0be5a13def81901b075f07f3d1f141056a406204d53f2f72ae53f583341
SHA3-384 hash: 349ae0c10f559fac1d5a0fd0afecda3e5d88f4c286a52c001a33edf3a061f864ca711ae9c0ffbd7c84896746355f60fc
SHA1 hash: 74e520b8ae0a896ccf5e78603c3829d7df701ba7
MD5 hash: f7c9f667cf886622d7851f7564891890
humanhash: zulu-kentucky-solar-three
File name:SecuriteInfo.com.VBA.Logan.1399.19236.22106
Download: download sample
File size:63'488 bytes
First seen:2021-04-22 15:43:14 UTC
Last seen:2021-04-23 05:16:50 UTC
File type:PowerPoint file ppt
MIME type:application/vnd.ms-powerpoint
ssdeep 192:LzUT4zi5acnlW1F0B7UUVHAY2F28x67/Vn5f3HGnxyXSBej0jp55XcvTBFoP8u9D:8T4GLoKf3nDVn5/HGnUCYg1XclFo39D
TLSH FD53E60073D1C126E0365AB2CEE7C7DA6731BD21BE51832B3098734F1DB64A19F69798
Reporter SecuriteInfoCom

Intelligence

File Origin
# of uploads :
2
# of downloads :
249
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL SHIPMENT WAYBILL-INVOICE PARCEL COMFIRMATION.msg
Verdict:
Malicious activity
Analysis date:
2021-04-22 13:27:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a02eec67-c7a7-470a-a7f3-fafb4c8a9119

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
TwinWave.EvilDoc.AutoExecSeparateWays.20200818.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.VBA.Logan.1399.19236.22106.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Result
Verdict:
Malicious
File Type:
Legacy PowerPoint File with Macro
Link:
https://app.docguard.net/934df0be5a13def81901b075f07f3d1f141056a406204d53f2f72ae53f583341/results/dashboard
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/934df0be5a13def81901b075f07f3d1f141056a406204d53f2f72ae53f583341
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/693366
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 395614 Sample: SecuriteInfo.com.VBA.Logan.... Startdate: 22/04/2021 Architecture: WINDOWS Score: 52 12 Multi AV Scanner detection for submitted file 2->12 14 Machine Learning detection for sample 2->14 6 cmd.exe 1 2->6         started        8 POWERPNT.EXE 501 3 2->8         started        process3 process4 10 POWERPNT.EXE 8 5 6->10         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/934df0be5a13def81901b075f07f3d1f141056a406204d53f2f72ae53f583341/
Threat name:
Document-Office.Trojan.Logan
Create hunting rule
Status:
Malicious
First seen:
2021-04-22 00:06:20 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro xlm
Link:
https://tria.ge/reports/210422-tf6tcmbrje/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/934df0be5a13def81901b075f07f3d1f141056a406204d53f2f72ae53f583341

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments