MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c25944185c3028763c67bbc31accb511402fe4d63fcabcff5494ef10361d7767. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c25944185c3028763c67bbc31accb511402fe4d63fcabcff5494ef10361d7767
SHA3-384 hash: 83f5affb27236e4c9c597141687a43e9c7210a3fc19030a9e65306cfa20e4cbfc632624b762104b4de0023a60f037bbd
SHA1 hash: 34440e5049f52397ef455a13f782147fb7ccf807
MD5 hash: 18d1d2d9b815884b6b8f28150ebfe8ed
humanhash: william-fruit-venus-alpha
File name:SecuriteInfo.com.Exploit.CVE-2016-7262.7958
Download: download sample
File size:18'510 bytes
First seen:2020-08-04 10:27:35 UTC
Last seen:Never
File type:Excel file xlsx
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep 384:Y2I3xFQKDxjEVYxdRkxjjV2RXmud7L3hUT65xZ3rLMR6NmIGuMB9Xmue5mQF5exf:1I3xFQKDxjEVYxdRkxjjV2R2ud7L3hUb
TLSH 3B8253D0EA95CE21EB412B3070F5F0615914F2B602C8BA0DFFC615AA6187ADF1C677CA
Reporter SecuriteInfoCom

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Exploit.CVE-2016-7262.7958.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
20 / 100
Link:
https://www.joesandbox.com/analysis/409243
Signature
a
c
d
e
f
g
h
i
L
M
n
o
p
r
s
t
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c25944185c3028763c67bbc31accb511402fe4d63fcabcff5494ef10361d7767/
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200804-rp48tycqa2/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Suspicious behavior: AddClipboardFormatListener
Checks processor information in registry
Enumerates system info in registry
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Exploit
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c25944185c3028763c67bbc31accb511402fe4d63fcabcff5494ef10361d7767

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PowerShell_Susp_Parameter_Combo
Create hunting rule
Author:Florian Roth
Description:Detects PowerShell invocation with suspicious parameters
Reference:https://goo.gl/uAic1X
Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:Suspicious_PowerShell_WebDownload_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious PowerShell code that downloads from web sites
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Excel file xlsx c25944185c3028763c67bbc31accb511402fe4d63fcabcff5494ef10361d7767

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/424259/
  
Delivery method
Distributed via web download

Comments