MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b3fc8083347fd5cea258502c5e42cbd7f56fe4bb9df0e3693ac145db2775078. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b3fc8083347fd5cea258502c5e42cbd7f56fe4bb9df0e3693ac145db2775078
SHA3-384 hash: e5d91253c8d300e26e8bd02bdddbcf806ca392fbd50fd550d1f90c1d7b337c97f70e36baeb24978efd3654473444f6f2
SHA1 hash: 182f66c623c10964a81060e199fd8b00182515d7
MD5 hash: 4cd16805ac1dee8e246f32c695b56788
humanhash: pluto-wisconsin-seven-nine
File name:9b3fc8083347fd5cea258502c5e42cbd7f56fe4bb9df0e3693ac145db2775078.doc
Download: download sample
File size:105'772 bytes
First seen:2025-08-07 11:40:07 UTC
Last seen:Never
File type:Word file doc
MIME type:text/rtf
ssdeep 3072:l+EYI5HtYJyAKim/ifzjLsRJryvksrpP89vL:lkwrdim/ifzjIRJrynpPwL
TLSH T13BA3AF2EE74F0955DF91A63B035A4A4909FCB33DB38140B579AC97343B9DC2E4A2297C
Magika rtf
Reporter JAMESWT_WT
Tags:198-55-102-200 CVE-2017-11882 doc

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

RTF Object

In this RTF file the following objects could be found:

IndexClass NameObjectFile sizeSHA256 hash
000015ABhn/an/a3'721 bytes 0a2b9c0cad32ed1e8fa3b7c436ecf7a2f422204715975abce910ebf1e5058615

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Factură .docx
Verdict:
Malicious activity
Analysis date:
2025-07-28 11:05:06 UTC
Tags:
webdav cve-2017-0199 exploit cve-2017-11882 susp-powershell purehvnc netreactor payload loader reverseloader
Link:
https://app.any.run/tasks/84d75b41-6cde-437b-aa91-28e977b5cfc9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Legit
File type:
application/msword
Has a screenshot:
False
Contains macros:
False
Detection(s):
Sanesecurity.Shelter.Malware.BadRtf.ObjUpd.UNOFFICIAL
Create hunting rule

MiscreantPunch.RTF.2017-0199.Obfus.171711.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689490f41e8a59ee04e6fe6e
Tags:
office virus shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching a process
Creating a window
Sending an HTTP GET request
Creating a file in the %AppData% directory
Сreating synchronization primitives
Creating a process with a hidden window
Launching a service
Sending an HTTP GET request to an infection source
Possible injection to a system process
Connection attempt by exploiting the app vulnerability
Connection attempt to an infection source
Creating a process from a recently created file
Result
Verdict:
Malicious
File Type:
Fake RTF File
Link:
https://app.docguard.net/9b3fc8083347fd5cea258502c5e42cbd7f56fe4bb9df0e3693ac145db2775078/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
embedequation exploit
Link:
https://www.filescan.io/uploads/689490d1397fd3ce6fa0b3f8/reports/eb0825b6-c9bc-4988-b017-3414d3c16219/overview
Verdict:
Malicious
Labled as:
CVE-2017-11882
Link:
https://www.hybrid-analysis.com/sample/9b3fc8083347fd5cea258502c5e42cbd7f56fe4bb9df0e3693ac145db2775078
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/9b3fc8083347fd5cea258502c5e42cbd7f56fe4bb9df0e3693ac145db2775078
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
RTF File
Link:
https://app.malva.re/file/4cd16805ac1dee8e246f32c695b56788
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b3fc8083347fd5cea258502c5e42cbd7f56fe4bb9df0e3693ac145db2775078/
Threat name:
Document-RTF.Exploit.CVE-2017-11882
Create hunting rule
Status:
Malicious
First seen:
2025-07-28 13:38:59 UTC
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tm74qcbti76vz2rfqubmlzbmxv7vn7slxhpq4nutvqkf3mtxkb4a._file
Verdict:
suspicious
Label(s):
purecrypter
Create hunting rule
Similar samples:
error
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/250807-ntc26sgn6w/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ecde827f-add2-49e6-a604-b6ed2a17d0e4
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9b3fc8083347fd5cea258502c5e42cbd7f56fe4bb9df0e3693ac145db2775078

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_INDICATOR_RTF_MalVer_Objects
Create hunting rule
Author:ditekSHen
Description:Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents.
Reference:https://github.com/ditekshen/detection

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments