MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c14b974e42e730a55e610964fb0bce6a8429bd31c6b71d35c82caf4015a3a921. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c14b974e42e730a55e610964fb0bce6a8429bd31c6b71d35c82caf4015a3a921
SHA3-384 hash:	a695811bf377980a08acbeb87d8665ad46f59f36d9f901b11201f6545a2722829147843dba9c1074fe7f092758ce27a8
SHA1 hash:	d6047abe8ba12fffa2d984510c391a2ce6e450ff
MD5 hash:	a9f09441e8b6fea4b043de2b3ea3009a
humanhash:	india-apart-leopard-double
File name:	Complaint details 2994.xlsb
Download:	download sample
Signature	Dridex Alert Create hunting rule
File size:	104'468 bytes
First seen:	2021-11-29 17:44:03 UTC
Last seen:	2021-12-06 14:53:57 UTC
File type:	xlsx
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	1536:8pWb3XP4duOZetZzaIs2pt9a4+0WEsu2xE1TjfGstjtbeUNDOaaonL4nx7d9s:bL4dX0FVa9Ub28Xf99tbekObUEx7d9s
TLSH	T16AA3F159E5F2D500DFFB45BD812A9F7B21539CC688C98FC799B9760C0A82E4231DC89C
Reporter	TeamDreier
Tags:	Dridex xlsx

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

175

Origin country :

n/a

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

Complaint details 2994.xlsb

Verdict:

No threats detected

Analysis date:

2021-11-29 17:50:03 UTC

Tags:

macros40

Link:

https://app.any.run/tasks/14a9ba44-f799-4050-8aab-b94b34368950

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

BitDam Malicious

Verdict:

Malicious

File type:

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

Has a screenshot:

False

Contains macros:

False

ClamAV Detected

Detection(s):

TwinWave.EvilDoc.XL4MDridexYourStringShilouette.20211102.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.XL4MDridexRunningDownTheDream.20211115.UNOFFICIAL

Alert

Create hunting rule

securiteinfo.com.xls4.icedid.42146.12007.16787.UNOFFICIAL

Alert

Create hunting rule

securiteinfo.com.xls4.icedid.42146.24744.28531.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

DNS request

Creating a window

Сreating synchronization primitives

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

OOXML Excel File with Excel4Macro

Link:

https://app.docguard.net/c14b974e42e730a55e610964fb0bce6a8429bd31c6b71d35c82caf4015a3a921/results/dashboard

Document image

Image:

Download PNG

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive mshta stripped

Link:

https://www.filescan.io/uploads/61a51166bbfd2af97cba7764/reports/ffa1634b-94a9-4aba-813d-842b741661b4/overview

Joe Sandbox Dridex Downloader

Result

Threat name:

Dridex Downloader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/898108

Signature

Contains functionality to create processes via WMI

Creates and opens a fake document (probably a fake document to hide exploiting)

Creates processes via WMI

Document exploit detected (process start blacklist hit)

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Sigma detected: Microsoft Office Product Spawning Windows Shell

Sigma detected: Suspicious MSHTA Process Patterns

Sigma detected: TA505 Dropper Load Pattern

Yara detected Dridex Downloader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c14b974e42e730a55e610964fb0bce6a8429bd31c6b71d35c82caf4015a3a921/

ReversingLabs TitaniumCloud Document-Excel.Infostealer.Dridex

Threat name:

Document-Excel.Infostealer.Dridex

Alert

Create hunting rule

Status:

Malicious

First seen:

2021-11-29 17:44:11 UTC

File Type:

Document

Extracted files:

20

AV detection:

17 of 28 (60.71%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yffzotsc44ykkxtbbfspwc6onkcctpjry23r2noifsxuafndveqq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

macro xlm

Link:

https://tria.ge/reports/211129-wa58lscedj/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c14b974e42e730a55e610964fb0bce6a8429bd31c6b71d35c82caf4015a3a921