MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98b8b208020aecb6d3f42ba67ee1faa1474ffc34468e3489758c04bc09504ee7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	98b8b208020aecb6d3f42ba67ee1faa1474ffc34468e3489758c04bc09504ee7
SHA3-384 hash:	9274336d64b080ea393c23c1543b4d73f22e956c8b464aadc73a03ba63b560ed7e824b94390e2037d1f2ef9852196b2e
SHA1 hash:	5bc33ee82212c3589721445a265b2221e3a8c7ea
MD5 hash:	f483a8986445cb90703ac59d3ca064fe
humanhash:	six-jupiter-quebec-pluto
File name:	98b8b208020aecb6d3f42ba67ee1faa1474ffc34468e3489758c04bc09504ee7
Download:	download sample
Signature	ZLoader Alert Create hunting rule
File size:	55'323 bytes
First seen:	2025-09-19 08:22:25 UTC
Last seen:	Never
File type:	xlsx
MIME type:	application/vnd.ms-excel
ssdeep	1536:kk3hOdsylKlgxopeiBNhZFGzE+cL2kdAAgYXFN:kk3hOdsylKlgxopeiBNhZFGzE+cL2kdH
TLSH	T1BE434DE3EA96DE75CAD483754B5B41D02312FC40566A838B72C1F63A3FBDAB0990D183
TrID	58.2% (.XLS) Microsoft Excel sheet (alternate) (56500/1/4) 33.5% (.XLS) Microsoft Excel sheet (32500/1/3) 8.2% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	xls
Reporter	JAMESWT_WT
Tags:	myftpupload-com xlsx ZLoader

Office OLE Information

---

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Application name is Microsoft Excel

Author of this document is VFdolf

File Format is MS Excel 97-2003

Container Format is OLE

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

342

Origin country :

IT

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

98b8b208020aecb6d3f42ba67ee1faa1474ffc34468e3489758c04bc09504ee7

Verdict:

No threats detected

Analysis date:

2025-09-19 08:30:44 UTC

Tags:

macros40

Link:

https://app.any.run/tasks/25864a5f-53b4-477c-9026-756f79366673

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/28285/

ClamAV Detected

Detection(s):

TwinWave.EvilDoc.ZloaderUnicodeRoadToNoWhere.20200720.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.ZloaderUnicodeRoadToNoWherePartDuex.20200730.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.Excel4.BlackSubmarines.2020.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.ZloaderGasPanic.20210216.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.Excel4UnicodeTransPoseReadyOrNot.ENABLE.210222.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.ZloaderBackToBasom.20201026.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68cd12eb246a2631bd30ffef

Tags:

extens trojan remo

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a file

Creating a file in the %temp% directory

Sending a custom TCP request

Launching a process by exploiting the app vulnerability

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

Legacy Excel File

Link:

https://app.docguard.net/98b8b208020aecb6d3f42ba67ee1faa1474ffc34468e3489758c04bc09504ee7/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive macros macros-on-open

Link:

https://www.filescan.io/uploads/68cd131f254431b688d4c3d2/reports/c4477abf-0c7a-4b7a-af07-db43a546ba2f/overview

Hybrid Analysis XF:AShadow.1

Verdict:

Malicious

Labled as:

XF:AShadow.1

Link:

https://www.hybrid-analysis.com/sample/98b8b208020aecb6d3f42ba67ee1faa1474ffc34468e3489758c04bc09504ee7

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

9.9/10

Score Malicious:

1%

Score Benign:

0%

Link:

https://www.malware.ai/gui/files/?id=3d1ec4f4-177f-4852-8f07-8edbe2b17a16

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/98b8b208020aecb6d3f42ba67ee1faa1474ffc34468e3489758c04bc09504ee7

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

xls

First seen:

2020-11-20T06:59:00Z UTC

Last seen:

2020-11-20T06:59:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/98b8b208020aecb6d3f42ba67ee1faa1474ffc34468e3489758c04bc09504ee7/results?tab=lookup

Nucleon Malprob Benign

Score:

25%

Verdict:

Benign

File Type:

OFFICE

Link:

https://malprob.io/report/98b8b208020aecb6d3f42ba67ee1faa1474ffc34468e3489758c04bc09504ee7

Malva.RE Malware

Verdict:

Malware

YARA:

4 match(es)

Tags:

Corrupted Office Document

Link:

https://app.malva.re/file/f483a8986445cb90703ac59d3ca064fe

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/98b8b208020aecb6d3f42ba67ee1faa1474ffc34468e3489758c04bc09504ee7/

ReversingLabs TitaniumCloud Document-Excel.Downloader.ZLoader

Threat name:

Document-Excel.Downloader.ZLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2020-11-12 22:03:04 UTC

File Type:

Document

Extracted files:

6

AV detection:

22 of 37 (59.46%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tc4lecacblwlnu7ufoth5yp2ufdu77bui2hdjclvrqclyckqj3tq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

macro xlm

Link:

https://tria.ge/reports/250919-kab4zsfr8s/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Badlisted process makes network request

Process spawned unexpected child process

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

loader zloader

YARA:

ZloaderXLS ZloaderXLSBehavior

Link:

https://app.threat.zone/submission/743da30a-e261-42a9-be81-265b7d09a8c9

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/98b8b208020aecb6d3f42ba67ee1faa1474ffc34468e3489758c04bc09504ee7

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/28285/

Comments

---

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample

Report a False Positive

×

Email:

If you provide your email address, we can give you feedback on your false positive report

Comment: Please describe why you think this file is a false positive

Note

False positives reports are handled by the Spamhaus Project. In case you provide your email address, someone from the Spamhaus Project may reach out to you to give you feedback on your false positive report.

Close Submit

Delete sample

×

You are about to delete this sample from MalwareBazaar. Do you want to continue?

Removal comment: Please quickly comment why you delete this file from MalwareBazaar

Cancel Delete

Add tag

×

Tag:

If you would like to add multiple tags at once, separate them by a comma - e.g. Emotet,exe,REvil

Close Add

Set Signature

×

Signature:

Close Set

Set File Type

×

File Type:

Close Set

Remove tag

×

Tag:

If you would like to add multiple tags at once, separate them by a comma - e.g. Emotet,exe,REvil

Close Remove