MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8eca270e07e96f414a4a5ff00c099f1518a9d10ca2f1a4c69800e37b9699fea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b8eca270e07e96f414a4a5ff00c099f1518a9d10ca2f1a4c69800e37b9699fea
SHA3-384 hash:	178d8ab75bde7a562a292a5d834d6770d5e0889a534e1716c8d3eb132afd9c5ca677214fa1b5f6e8d75eb63cbbab55ef
SHA1 hash:	e02ca1f851d0ac8d6ed8b05d1aa0da9849828f1e
MD5 hash:	8f8eefcab7190efc401abbed9d9950f4
humanhash:	lion-fanta-uncle-lake
File name:	148.xls
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	989'184 bytes
First seen:	2026-07-21 06:30:25 UTC
Last seen:	Never
File type:	xls
MIME type:	application/vnd.ms-excel
ssdeep	12288:ZGfwI82f25OdTezN4ee+KahN0QwKF2UElH7k1kyaNsUrS/RQs9ezhg55PZKbs0uB:YfwI/u+eR4eNK1QwKFgEvKhgDZKbs/
TLSH	T1A7252349FAFEEB21F1F691384935C50846CECE98A775824F326872045735B3E728E96C
TrID	47.4% (.XLS) Microsoft Excel sheet (32500/1/3) 40.8% (.XLS) Microsoft Excel sheet (alternate) (28000/1/3) 11.6% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	xls
Reporter	lowmal3
Tags:	PureLogsStealer xls

Office OLE Information

---

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Application name is Microsoft Excel

File Format is MS Excel 97-2003

Container Format is OLE

Office document is in encrypted

OLE dump

MalwareBazaar was able to identify 7 sections in this file using oledump:

Section ID	Section size	Section name
1	114 bytes	CompObj
2	244 bytes	DocumentSummaryInformation
3	200 bytes	SummaryInformation
4	99 bytes	MBD00039282/CompObj
5	708661 bytes	MBD00039282/Package
6	678 bytes	MBD00039283/Ole
7	267274 bytes	Workbook

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

211

Origin country :

DE

Vendor Threat Intelligence

ACCE CVE_2018_8174 OLE_FileType

Malware configuration found for:

MSO

Details

Link:

https://research.acce.ciphertechsolutions.com/results/7955663e-de65-4f8b-860d-4b6a34c04007/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

ển+tiền.xls

Verdict:

No threats detected

Analysis date:

2026-07-15 09:22:47 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/6dc3ca45-de92-4425-854c-aa8cf9f25923

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

BitDam Legit

Verdict:

Legit

File type:

application/vnd.ms-excel

Has a screenshot:

False

Contains macros:

False

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/75510/

ClamAV Detected

Detection(s):

SecuriteInfo.com.X97M.DownLoader.2343.30562.20209.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5f122bbcffb2c48cb7a9e3

Tags:

trojan shell agent

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

Legacy Excel File

Link:

https://app.docguard.net/b8eca270e07e96f414a4a5ff00c099f1518a9d10ca2f1a4c69800e37b9699fea/results/dashboard

Behaviour

SuspiciousRTF detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

CVE-2017-0199 downloader evasive exploit macros

Link:

https://www.filescan.io/uploads/6a5f1220c6d0ad38e66d05c4/reports/d91874f8-d8dc-4467-8a44-bebfb3bc0210/overview

Hybrid Analysis CVE-2017-0199

Verdict:

Malicious

Labled as:

CVE-2017-0199

Link:

https://www.hybrid-analysis.com/sample/b8eca270e07e96f414a4a5ff00c099f1518a9d10ca2f1a4c69800e37b9699fea

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

3/10

Score Malicious:

3%

Score Benign:

97%

Link:

https://www.malware.ai/gui/files/?id=fe4c24cc-fec3-4242-88ea-26e3c68fe9f9

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

xls

First seen:

2026-07-14T06:59:00Z UTC

Last seen:

2026-07-23T04:35:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/b8eca270e07e96f414a4a5ff00c099f1518a9d10ca2f1a4c69800e37b9699fea/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1945655

Signature

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

OFFICE

Link:

https://malprob.io/report/b8eca270e07e96f414a4a5ff00c099f1518a9d10ca2f1a4c69800e37b9699fea

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Office Document

Link:

https://app.malva.re/file/8f8eefcab7190efc401abbed9d9950f4

CERT.PL MWDB purelogs

Detection:

purelogs

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/b8eca270e07e96f414a4a5ff00c099f1518a9d10ca2f1a4c69800e37b9699fea/

ReversingLabs TitaniumCloud Win32.Trojan.Ravartar

Threat name:

Win32.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-14 13:01:43 UTC

File Type:

Document

Extracted files:

47

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xdwke4hap2lpiffeux7qbqez6fiyvhiqzixrutdjqahdpoljt7va._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

persistence ransomware

Link:

https://tria.ge/reports/260721-g92l5saw2t/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b8eca270e07e96f414a4a5ff00c099f1518a9d10ca2f1a4c69800e37b9699fea

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

PureLogsStealer

xls b8eca270e07e96f414a4a5ff00c099f1518a9d10ca2f1a4c69800e37b9699fea

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/75510/

Comments

---

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample

Report a False Positive

×

Email:

If you provide your email address, we can give you feedback on your false positive report

Comment: Please describe why you think this file is a false positive

Note

False positives reports are handled by the Spamhaus Project. In case you provide your email address, someone from the Spamhaus Project may reach out to you to give you feedback on your false positive report.

Close Submit

Delete sample

×

You are about to delete this sample from MalwareBazaar. Do you want to continue?

Removal comment: Please quickly comment why you delete this file from MalwareBazaar

Cancel Delete

Add tag

×

Tag:

If you would like to add multiple tags at once, separate them by a comma - e.g. Emotet,exe,REvil

Close Add

Set Signature

×

Signature:

Close Set

Set File Type

×

File Type:

Close Set

Remove tag

×

Tag:

If you would like to add multiple tags at once, separate them by a comma - e.g. Emotet,exe,REvil

Close Remove