MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aee97da6e86ebebfb355e919326ac42ef50b256b513a52f671f9ed596eeee27a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Maldoc score: 9

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	aee97da6e86ebebfb355e919326ac42ef50b256b513a52f671f9ed596eeee27a
SHA3-384 hash:	1e18a95dc624499f4ba3882f0e624c4c1f88f2953701de875bd455db67d2ad5c0a2afa1adcbbd3128f1af3c0f28aeae6
SHA1 hash:	04fdd6e64dcbee2fd0ee51dd780be68d7e33a973
MD5 hash:	7ef963d472b01aaa20117ef037cde0f8
humanhash:	bulldog-one-magazine-ceiling
File name:	SecuriteInfo.com.HEUR.Trojan.OLE2.UrcBadur.genw.10895.7187
Download:	download sample
File size:	769'536 bytes
First seen:	2026-07-24 23:44:55 UTC
Last seen:	2026-07-25 00:23:26 UTC
File type:	xlsx
MIME type:	application/vnd.ms-excel
ssdeep	12288:HrMmLjH+8sIkTgIsyMSMDbzghV1brNi/xHHJiEzxSpwOSDdgsaJE:H4mLjCIkkjwbnNi/5pi6xT18J
TLSH	T198F42311F9408827F813A2B5C8E5E0DB1458DDAA8653C02B38477BAF7671BB7716738B
TrID	34.9% (.XLS) Microsoft Excel sheet (32500/1/3) 30.1% (.XLS) Microsoft Excel sheet (alternate) (28000/1/3) 26.3% (.XLS) Microsoft Excel sheet (alternate) (24500/1/2) 8.6% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	xls
Reporter	SecuriteInfoCom
Tags:	xlsx

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 9

Application name is Microsoft Excel

File Format is MS Excel 97-2003

Container Format is OLE

Office document is in encrypted

Office document contains VBA Macros

OLE dump

MalwareBazaar was able to identify 15 sections in this file using oledump:

Section ID	Section size	Section name
1	114 bytes	CompObj
2	244 bytes	DocumentSummaryInformation
3	200 bytes	SummaryInformation
4	99 bytes	MBD00240DC7/CompObj
5	350481 bytes	MBD00240DC7/Package
6	766 bytes	MBD00240DC8/Ole
7	398658 bytes	Workbook
8	525 bytes	_VBA_PROJECT_CUR/PROJECT
9	104 bytes	_VBA_PROJECT_CUR/PROJECTwm
10	977 bytes	_VBA_PROJECT_CUR/VBA/Sheet1
11	977 bytes	_VBA_PROJECT_CUR/VBA/Sheet2
12	977 bytes	_VBA_PROJECT_CUR/VBA/Sheet3
13	985 bytes	_VBA_PROJECT_CUR/VBA/ThisWorkbook
14	2644 bytes	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
15	553 bytes	_VBA_PROJECT_CUR/VBA/dir

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
Suspicious	Hex Strings	Hex-encoded strings were detected, may beused to obfuscate strings (option --decode tosee all)

Intelligence

File Origin

# of uploads :

# of downloads :

146

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

MSO

Details

Link:

https://research.acce.ciphertechsolutions.com/results/35ceb103-60b0-4c83-85be-635bc6a424bf/

Verdict:

Legit

File type:

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

Has a screenshot:

False

Contains macros:

False

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/76011/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

Creating a process with a hidden window

Connection attempt

Launching a process

Possible injection to a system process

Connection attempt by exploiting the app vulnerability

Sending an HTTP GET request

Unauthorized injection to a recently created process by context flags manipulation

Bypassing of proactive protection methods using Windows Management Instrumentation (WMI)

Sending a custom TCP request by exploiting the app vulnerability

Launching a process by exploiting the app vulnerability

Unauthorized injection to a system process

Result

Verdict:

Malicious

File Type:

Legacy Excel File with Macro

Link:

https://app.docguard.net/aee97da6e86ebebfb355e919326ac42ef50b256b513a52f671f9ed596eeee27a/results/dashboard

Payload URLs

URL

File name

http:\\000015353307470/alison.comtagcloud-computingutm_source=bing&utm_medium=cpc&utm_campaign=533576939&utm_content=13535015313125000.php?id=utm_term=kwd-2336393490735596:loc-90&msclkid=f35aaf9dc22b1f1a4a2bc5fff8ef9d2f

Embedded Ole

Behaviour

SuspiciousRTF detected

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

macros

Link:

https://www.filescan.io/uploads/6a63f9310b24fa04146a6ba4/reports/1c17a846-a4d1-40eb-9c2f-05b41686902f/overview

Verdict:

Malicious

Labled as:

CVE-2017-0199

Link:

https://www.hybrid-analysis.com/sample/aee97da6e86ebebfb355e919326ac42ef50b256b513a52f671f9ed596eeee27a

Label:

Malicious

Suspicious Score:

10/10

Score Malicious:

Score Benign:

Link:

https://www.malware.ai/gui/files/?id=3ecd9be7-6638-4bb3-8451-7c8541225ef0

Verdict:

Malicious

File Type:

xls

First seen:

2026-07-24T01:06:00Z UTC

Last seen:

2026-07-24T20:29:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/aee97da6e86ebebfb355e919326ac42ef50b256b513a52f671f9ed596eeee27a/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

OFFICE

Link:

https://malprob.io/report/aee97da6e86ebebfb355e919326ac42ef50b256b513a52f671f9ed596eeee27a

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aee97da6e86ebebfb355e919326ac42ef50b256b513a52f671f9ed596eeee27a/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v3ux3jxin27l7m2v5emte2wef32qwjllke5ff5tr7hwvs3xo4j5a._file

Result

Malware family:

n/a

Score:

1/10

Tags:

persistence ransomware

Link:

https://tria.ge/reports/260724-3r7akahl2w/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/aee97da6e86ebebfb355e919326ac42ef50b256b513a52f671f9ed596eeee27a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	informational_win_ole_protected Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Identify OLE Project protection within documents.

Rule name:	XLS_STRINGS Create hunting rule
Author:	somedieyoungZZ
Description:	Detect Strings targeting Bangladesh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/76011/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample