MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 99084dbcdd515d06f52ce70d9bae005c5de108a9b1679b5844dae2e77ae559dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 9
| SHA256 hash: | 99084dbcdd515d06f52ce70d9bae005c5de108a9b1679b5844dae2e77ae559dc |
|---|---|
| SHA3-384 hash: | 1667ab0ac76dac634ccef71de376453355a4c4286ba97617b549d1c40fcc8ca078d6968782049de5d0e31436c4aa2eea |
| SHA1 hash: | b9a20447aaf5d22638e55e2f178de5956a50ca5c |
| MD5 hash: | 963fd9903518e49e3bd7bc853e55a827 |
| humanhash: | quiet-harry-arizona-maine |
| File name: | Orden-MX-6020491556.xlsx |
| Download: | download sample |
| File size: | 357'888 bytes |
| First seen: | 2022-04-14 05:41:20 UTC |
| Last seen: | Never |
| File type: |  xlsx |
| MIME type: | application/encrypted |
| ssdeep | 6144:rp9u+wZQSrcBeKcr8rU6KadfM4PtD8iHXcehIUDNARHMMp96s5rh:t9u+gQ/7FNuq8A1StMfw |
| TLSH | T1917423186206EAF3E2A394F50C43561E74A6FE2CBE03F1698B5A3339587874374E319D |
| Reporter |  abuse_ch |
| Tags: | CVE-2018-0802 VelvetSweatshop xlsx |
Office OLE Information
This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.
OLE dump
| Detection: VelvetSweatshop |
MalwareBazaar was able to identify 6 sections in this file using oledump:
| Section ID | Section size | Section name |
|---|---|---|
| 1 | 64 bytes | DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace |
| 2 | 112 bytes | DataSpaces/DataSpaceMap |
| 3 | 208 bytes | DataSpaces/TransformInfo/StrongEncryptionTransform/Primary |
| 4 | 76 bytes | DataSpaces/Version |
| 5 | 351112 bytes | EncryptedPackage |
| 6 | 224 bytes | EncryptionInfo |
Intelligence
File Origin
# of uploads :
1
# of downloads :
236
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Orden-MX-6020491556.xlsx
Verdict:
No threats detected
Analysis date:
2022-04-14 08:45:43 UTC
Tags:
encrypted
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
Has a screenshot:
False
Contains macros:
False
Detection:
n/a
Detection(s):
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Creating a window
Searching for synchronization primitives
Launching a process
Сreating synchronization primitives
Result
Verdict:
Malicious
File Type:
OOXML Excel File with Embedding Objects in Encrypted Excel File
Document image
Image:
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
embedequation exploit shellcode VelvetSweatshop
Label:
Malicious
Suspicious Score:
6.5/10
Score Malicious:
65%
Score Benign:
35%
Result
Verdict:
MALICIOUS
Link:
Details
Document With No Content
Document contains little or no semantic information.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl
Score:
56 / 100
Signature
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Behaviour
Behavior Graph:
Threat name:
Document-Office.Exploit.CVE-2018-0802
Status:
Malicious
First seen:
2022-04-14 04:44:06 UTC
File Type:
Document
Extracted files:
63
AV detection:
14 of 41 (34.15%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
Checks processor information in registry
Enumerates system info in registry
Launches Equation Editor
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Blocklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
xlsx 99084dbcdd515d06f52ce70d9bae005c5de108a9b1679b5844dae2e77ae559dc
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.