MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a90b47db3b8967d11477fddf847f7e2edd6933462b90998fc4b32ae4023348fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a90b47db3b8967d11477fddf847f7e2edd6933462b90998fc4b32ae4023348fa
SHA3-384 hash:	bf076f8df4a1f0e4725ba5ebc76348c858e61552a2719cec88e326f1297db7a6552d2c335dd809b4ba7ebcc427b5bb54
SHA1 hash:	8a9d0ea7a683e05af507a385e3f69cc012ab2fd6
MD5 hash:	4abdd84a9ac2da83f53bb00027f2af8f
humanhash:	edward-vegan-juliet-edward
File name:	Inquiry.docx
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	469'737 bytes
First seen:	2024-10-31 09:42:40 UTC
Last seen:	Never
File type:	doc
MIME type:	application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep	6144:KEbUb0cVLNEzYvRSPlaMXKaAi69qltTGSmNZ5W9tmYL6qoPQ7tmYB/l2mDlJjAIH:nkF5SPMM6I9X4X89mrm9Bt2mhW8G0Yq
TLSH	T1D1A412300CC7D0FC4B13F869FAD5225923EC6D235D071974A66ABA6A33598A2C773F16
TrID	52.2% (.DOCX) Word Microsoft Office Open XML Format document (23500/1/4) 38.8% (.ZIP) Open Packaging Conventions container (17500/1/4) 8.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	docx
Reporter	lowmal3
Tags:	doc FormBook

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

3'202

Origin country :

DE

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

Inquiry.docx

Verdict:

Suspicious activity

Analysis date:

2024-10-31 09:56:20 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3d247a46-7c0a-426c-8e72-5ce09b44fa19

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

TwinWave.EvilDoc.OkayLureDefenderWord.20220418.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.27321.XmlHeur.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.30525.XmlHeur.UNOFFICIAL

Alert

Create hunting rule

Doc.Downloader.Loda-7570590-0

Alert

Create hunting rule

TwinWave.EvilDoc.RelsPublicDottedQuadDancingInHeaven.20211202.UNOFFICIAL

Alert

Create hunting rule

MiscreantPunch.Suspicious.RemoteTemplateCall.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6723512c8d23d90491323260

Tags:

office agent micro

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Using the Windows Management Instrumentation requests

Creating a window

Creating a file

DNS request

Connection attempt

Sending a custom TCP request

Connection attempt by exploiting the app vulnerability

Launching a process by exploiting the app vulnerability

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

OOXML Word File

Link:

https://app.docguard.net/a90b47db3b8967d11477fddf847f7e2edd6933462b90998fc4b32ae4023348fa/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/6723512a17b6426a2609a462/reports/28241a1b-b19c-4f0d-af91-14fd0e76a80f/overview

Hybrid Analysis CVE-2017-11882

Verdict:

Malicious

Labled as:

CVE-2017-11882

Link:

https://www.hybrid-analysis.com/sample/a90b47db3b8967d11477fddf847f7e2edd6933462b90998fc4b32ae4023348fa

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

9.6/10

Score Malicious:

97%

Score Benign:

3%

Link:

https://www.malware.ai/gui/files/?id=86fbe486-e2dd-49a1-9c1b-67749496996a

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/a90b47db3b8967d11477fddf847f7e2edd6933462b90998fc4b32ae4023348fa

Details

IPv4 Dotted Quad URL

A URL was detected referencing a direct IP address, as opposed to a domain name.

External Relationship Element

Document contains an externally hosted relationship, which fetches further content.

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1545953

Signature

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Antivirus detection for dropped file

Contains an external reference to another file

Document exploit detected (process start blacklist hit)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Microsoft Office drops suspicious files

Microsoft Office launches external ms-search protocol handler (WebDAV)

Multi AV Scanner detection for submitted file

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Office viewer loads remote template

Shellcode detected

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: Equation Editor Network Connection

Sigma detected: File Dropped By EQNEDT32EXE

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Sigma detected: Suspicious Microsoft Office Child Process

Suricata IDS alerts for network traffic

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

12%

Verdict:

Benign

File Type:

OFFICE

Link:

https://malprob.io/report/a90b47db3b8967d11477fddf847f7e2edd6933462b90998fc4b32ae4023348fa

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a90b47db3b8967d11477fddf847f7e2edd6933462b90998fc4b32ae4023348fa/

ReversingLabs TitaniumCloud Document-Word.Trojan.Groooboor

Threat name:

Document-Word.Trojan.Groooboor

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-10-30 10:55:19 UTC

File Type:

Document

Extracted files:

20

AV detection:

13 of 24 (54.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vefupwz3rft5cfdx7xpyi736f3owsm2gfoijtd6ewmvoiartjd5a._file

Threatray formbook unknown_loader_037

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

unknown_loader_037

Alert

Create hunting rule

Similar samples:

error

Formbook

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution

Link:

https://tria.ge/reports/241031-lpxjxaxldn/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Launches Equation Editor

Modifies Internet Explorer settings

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Office loads VBA resources, possible macro or embedded object present

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Drops file in System32 directory

Suspicious use of SetThreadContext

Abuses OpenXML format to download file from external location

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Process spawned unexpected child process

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/f5b6b38b-c955-4719-955b-518ba17a5f41

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a90b47db3b8967d11477fddf847f7e2edd6933462b90998fc4b32ae4023348fa