MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa1b0bd9407c53f3e91b091849b9e008e3a85c4e2c1268812a0bf8daadbb22d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Maldoc score: 1105


Intelligence 4 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa1b0bd9407c53f3e91b091849b9e008e3a85c4e2c1268812a0bf8daadbb22d6
SHA3-384 hash: a8b5f115761213bc478c1022f95d5335e4d909bbe9494a950ca5218fcf7e7594322d5370354a289f60062048560babb3
SHA1 hash: c1fa1cee5c8a014ed27d237d0c1068f10c96e1e1
MD5 hash: 74f12d6f5591b015293c379f7eddd69c
humanhash: zulu-xray-missouri-triple
File name:aa1b0bd9407c53f3e91b091849b9e008e3a85c4e2c1268812a0bf8daadbb22d6
Download: download sample
File size:263'071 bytes
First seen:2026-07-30 07:28:20 UTC
Last seen:Never
File type:Excel file xlsx
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep 6144:E/sQfDFslRhSVaqJK+W7bB+vZ4XcLO8mpvAMc122A39:E/s7+oB+vaXc6Dvm12d39
TLSH T18C44E1F5303B9749C623673F52B01EE67B343AEC084F68E533A5782A6DE277C12651A1
TrID 61.2% (.XLSX) Excel Microsoft Office Open XML Format document (34000/1/7)
31.5% (.ZIP) Open Packaging Conventions container (17500/1/4)
7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika xlsx
Reporter Anonymous
Tags:xlsx

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 1105
File Format is MS Excel 2007+
Container Format is OpenXML

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
EG EG
Vendor Threat Intelligence
Malware configuration found for:
MSO
Details
Link:
https://research.acce.ciphertechsolutions.com/results/15e1ffe4-ebcb-4e84-b833-5341b7fcb03d/
Verdict:
Legit
File type:
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
Has a screenshot:
False
Contains macros:
False
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/76794/
Detection(s):
SecuriteInfo.com.HTML-51912.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.HTML-58285.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.HTML-59270.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.HTML-59202.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.HTML-58707.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.HTML-56268.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.HTML-53484.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.HTML-50661.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.HTML-51499.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.HTML-55216.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.HTML-59384.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.HTML-52527.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.HTML-58852.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.HTML-59396.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Result
Verdict:
Clean
File Type:
OOXML Excel File
Link:
https://app.docguard.net/aa1b0bd9407c53f3e91b091849b9e008e3a85c4e2c1268812a0bf8daadbb22d6/results/dashboard
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6a6afd1fa78ed08e853a243c/reports/c06ff829-48b1-483b-bf42-9ded025e076b/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/aa1b0bd9407c53f3e91b091849b9e008e3a85c4e2c1268812a0bf8daadbb22d6
Label:
Benign
Suspicious Score:
3/10
Score Malicious:
4%
Score Benign:
96%
Link:
https://www.malware.ai/gui/files/?id=7e849abd-d604-41cf-a577-319a9ea0e331
Verdict:
Unknown
File Type:
xlsx
Link:
https://opentip.kaspersky.com/aa1b0bd9407c53f3e91b091849b9e008e3a85c4e2c1268812a0bf8daadbb22d6/results?tab=lookup
Score:
0%
Verdict:
Benign
File Type:
OFFICE
Link:
https://malprob.io/report/aa1b0bd9407c53f3e91b091849b9e008e3a85c4e2c1268812a0bf8daadbb22d6
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Office Document
Link:
https://app.malva.re/file/74f12d6f5591b015293c379f7eddd69c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa1b0bd9407c53f3e91b091849b9e008e3a85c4e2c1268812a0bf8daadbb22d6/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vinqxwkaprj7h2i3bemetopabdr2qxcofqjgrajkbp4nvln3ella._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/260730-jax6satbmf/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/aa1b0bd9407c53f3e91b091849b9e008e3a85c4e2c1268812a0bf8daadbb22d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dsc
Create hunting rule
Author:Aaron DeVera
Description:Discord domains
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:SUSP_Websites
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference of suspicious sites that might be used to download further malware
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string
Rule name:test_rule_vldslv
Create hunting rule
Rule name:ZKM_Stealer_26_Network
Create hunting rule
Author:Brian (Omaha) - victim forensic investigation
Description:Detects ZKM Stealer 26.0.0 via network infrastructure indicators

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/76794/

Comments