MalwareBazaar Database

Intelligence

File Origin

Origin country :

SE

Vendor Threat Intelligence

ACCE OOXML_FileType

Details

Link:

https://research.acce.ciphertechsolutions.com/results/7e86d722-fdfa-4f26-967d-a61d567a59a5/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

xlsm

Verdict:

No threats detected

Analysis date:

2026-04-17 13:23:27 UTC

Tags:

macros macros-on-open doc-url

Link:

https://app.any.run/tasks/d097203c-416d-4c6c-9375-1e146c2a5915

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/61955/

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69e233aef68adfe1003ac04c

Tags:

whiteice office macro micro

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Launching a service

Searching for synchronization primitives

Creating a file

Delayed writing of the file

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

Excel File with Macro

Link:

https://app.docguard.net/b908e32fa44d7672a1a6058355404cf26315ea9e1ff07a34c8ea14fd99241c4f/results/dashboard

Behaviour

BlacklistAPI detected

Document image

Image:

Download PNG

FileScan.io

Gathering data

Hybrid Analysis Msoffice/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Msoffice/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/b908e32fa44d7672a1a6058355404cf26315ea9e1ff07a34c8ea14fd99241c4f

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

/10

Score Malicious:

%

Score Benign:

1%

Link:

https://www.malware.ai/gui/files/?id=0a7e0dc0-4647-469b-8e69-81cbbc841b07

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/b908e32fa44d7672a1a6058355404cf26315ea9e1ff07a34c8ea14fd99241c4f

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

xlsm

Link:

https://opentip.kaspersky.com/b908e32fa44d7672a1a6058355404cf26315ea9e1ff07a34c8ea14fd99241c4f/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1900081

Signature

Document contains an embedded VBA macro with suspicious strings

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

OFFICE

Link:

https://malprob.io/report/b908e32fa44d7672a1a6058355404cf26315ea9e1ff07a34c8ea14fd99241c4f

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b908e32fa44d7672a1a6058355404cf26315ea9e1ff07a34c8ea14fd99241c4f/

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/b908e32fa44d7672a1a6058355404cf26315ea9e1ff07a34c8ea14fd99241c4f

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-04-11 16:03:05 UTC

File Type:

Document

Extracted files:

547

AV detection:

7 of 36 (19.44%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xeeogl5ejv3hfingawbvkqcm6jrrl2u6d7yhungi5ikp3gjedrhq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/260417-qlbv9ahy7y/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/b908e32fa44d7672a1a6058355404cf26315ea9e1ff07a34c8ea14fd99241c4f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/61955/

Comments