MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2f39ccb743f8122448c5e7fea2319fbb4da4718e4f54dce5d5ad5367c93338a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Maldoc score: 12


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2f39ccb743f8122448c5e7fea2319fbb4da4718e4f54dce5d5ad5367c93338a
SHA3-384 hash: c9c942d52253b22aaf9d7cd8c2cbe068a9ab278d78b0603e4c978eb0c0aec7db1873ec10fec778f9346f2311c16d84fc
SHA1 hash: e7f185ea583d8a74621e4ffe37ded86ce27302cc
MD5 hash: 50079e9d0aa5353c8eca8fc3a0b2637c
humanhash: missouri-seven-oklahoma-potato
File name:22017 lmf - RDI WHS.xls
Download: download sample
File size:129'024 bytes
First seen:2022-10-12 07:51:31 UTC
Last seen:Never
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 3072:9k3hOdsylKlgryzc4bNhZFGzE+cL2knA29pWkmanzr0O8JFKdshErlsD3:9k3hOdsylKlgryzc4bNhZF+E+W2knA2I
TLSH T13BC3F807A99484ABE35843B57C876FFD7B586F08A9062BFF24117F9B3EB52014D4B01A
TrID 46.5% (.XLS) Microsoft Excel sheet (alternate) (56500/1/4)
26.7% (.XLS) Microsoft Excel sheet (32500/1/3)
20.1% (.XLS) Microsoft Excel sheet (alternate) (24500/1/2)
6.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter abuse_ch
Tags:xls


Avatar
abuse_ch
Payload URL:
https://teleldyne.com/paytm/jarred.exe

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 12
OLE dump

MalwareBazaar was able to identify 15 sections in this file using oledump:

Section IDSection sizeSection name
1107 bytesCompObj
2244 bytesDocumentSummaryInformation
3224 bytesSummaryInformation
483978 bytesWorkbook
5461 bytes_VBA_PROJECT_CUR/PROJECT
686 bytes_VBA_PROJECT_CUR/PROJECTwm
730116 bytes_VBA_PROJECT_CUR/VBA/Module1
8977 bytes_VBA_PROJECT_CUR/VBA/Sheet1
9985 bytes_VBA_PROJECT_CUR/VBA/ThisWorkbook
102905 bytes_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
111254 bytes_VBA_PROJECT_CUR/VBA/__SRP_0
12124 bytes_VBA_PROJECT_CUR/VBA/__SRP_1
13154 bytes_VBA_PROJECT_CUR/VBA/__SRP_2
14434 bytes_VBA_PROJECT_CUR/VBA/__SRP_3
15568 bytes_VBA_PROJECT_CUR/VBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecAutoOpenRuns when the Word document is opened
AutoExecAuto_OpenRuns when the Excel Workbook is opened
SuspiciousShellMay run an executable file or a system command
SuspiciousvbHideMay run an executable file or a system command
SuspiciousChrMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
223
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/319254/
Detection(s):
TwinWave.EvilDoc.DOCXSTRGOOD.//
Create hunting rule

TwinWave.EvilDoc.StringBuidlersEveryRoseHasItsThorn.20210308.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.TakeMeHomeTonight.20210923.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Office.Macro-13.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.OutRunThis.20220121.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Creating a process from a recently created file
Running batch commands
DNS request
Searching for the window
Sending a custom TCP request
Creating a window
Сreating synchronization primitives
Running batch commands by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
Legacy Excel File with Macro
Link:
https://app.docguard.net/c2f39ccb743f8122448c5e7fea2319fbb4da4718e4f54dce5d5ad5367c93338a/results/dashboard
Behaviour
BlacklistAPI detected
Document image
Image:
Download PNG
Document image
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
certutil certutil.exe cmd cmd.exe macros macros-on-open packed timeout wscript
Link:
https://www.filescan.io/uploads/63467224316b332dfca8de25/reports/caf86606-899b-415b-afd5-556c95a95f8d/overview
Label:
Malicious
Suspicious Score:
6.3/10
Score Malicious:
64%
Score Benign:
36%
Link:
https://www.malware.ai/gui/files/?id=4895193b-a74c-47a2-8117-f7ed6145d07c
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/c2f39ccb743f8122448c5e7fea2319fbb4da4718e4f54dce5d5ad5367c93338a
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
Macro with Hidden Shell
The VBA Shell() command is leveraged by this macro with a window style of '0' or 'vbHide'.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1088667
Signature
.NET source code contains very large strings
Command shell drops VBS files
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA with base64 encoded strings
Document contains an embedded VBA with many string operations indicating source code obfuscation
Document exploit detected (process start blacklist hit)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 721270 Sample: 22017 lmf - RDI WHS.xls Startdate: 12/10/2022 Architecture: WINDOWS Score: 96 45 Multi AV Scanner detection for submitted file 2->45 47 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->47 49 Machine Learning detection for sample 2->49 51 6 other signatures 2->51 9 EXCEL.EXE 53 13 2->9         started        process3 file4 33 C:\Users\user\...\22017 lmf - RDI WHS.xls, Composite 9->33 dropped 12 cmd.exe 2 9->12         started        process5 file6 41 C:\Users\user\AppData\Local\Temp\script.vbs, ASCII 12->41 dropped 57 Command shell drops VBS files 12->57 16 wscript.exe 1 12->16         started        18 timeout.exe 12->18         started        20 timeout.exe 12->20         started        signatures7 process8 process9 22 cmd.exe 16->22         started        24 cmd.exe 16->24         started        process10 26 certutil.exe 14 22->26         started        31 bin.exe 1 5 24->31         started        dnsIp11 43 teleldyne.com 199.188.200.156, 443, 49173, 49174 NAMECHEAP-NETUS United States 26->43 35 C:\Users\user\AppData\Local\Temp\bin.exe, PE32 26->35 dropped 37 C:\Users\user\AppData\Local\...\jarred[1].exe, PE32 26->37 dropped 39 C:\Users\...\91CFEDCD938EF461E274B69462F6C588, PE32 26->39 dropped 53 System process connects to network (likely due to code injection or exploit) 26->53 55 Machine Learning detection for dropped file 31->55 file12 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2f39ccb743f8122448c5e7fea2319fbb4da4718e4f54dce5d5ad5367c93338a/
Threat name:
Win32.Trojan.Valyria
Create hunting rule
Status:
Malicious
First seen:
2022-10-12 00:32:04 UTC
File Type:
Document
Extracted files:
20
AV detection:
16 of 41 (39.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ylzzzs3uh6aseremlz76uiyz7o2nuryy4t2u3ts5llktm7etgofa._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
macro macro_on_action
Link:
https://tria.ge/reports/221012-jqdr3schf2/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
Process spawned unexpected child process
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/113e297e-bb46-41bc-8f50-163622b7e227
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c2f39ccb743f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2f39ccb743f8122448c5e7fea2319fbb4da4718e4f54dce5d5ad5367c93338a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
URLhaus
https://urlhaus.abuse.ch/url/2365819/
Cape
Cape
https://www.capesandbox.com/analysis/319254/

Comments