MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc8c9f5b7a3a6d049cdb9a484fb0f39b0cf8d7f73dfc78b495c9580a93363f64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	cc8c9f5b7a3a6d049cdb9a484fb0f39b0cf8d7f73dfc78b495c9580a93363f64
SHA3-384 hash:	53b731b38643d695adc735c168e1a8da9370d89abb81ef6e89ef54a9b14a010171b9ef66ac4594ed8c1d55211d5ed03d
SHA1 hash:	4ac2d5c8ee6b47fc76fb222d22ae818db3a445b1
MD5 hash:	801e4d123e935445e5f5109c8150b397
humanhash:	pasta-alanine-tango-virginia
File name:	prlmttsourcegoodforbestperformanceprlmttsourcego__________prlmttsourcegoodforbestperformance_____prlmttsourcegoodforbestperformanceprlmttsourcegoodforbestperformance.doc
Download:	download sample
File size:	90'296 bytes
First seen:	2025-05-24 23:06:19 UTC
Last seen:	2025-05-25 01:28:26 UTC
File type:	doc
MIME type:	text/rtf
ssdeep	1536:XMeu0t9sQd2rNEZ7PkbhasZb2kLaysaPo+CD5Zz90/WolEtHMWgfcJJpYCQQeGor:XzXTLsrNEZLkFasZCkL0MoB5Zi/wRMW0
TLSH	T17393F52EE70F0955DF55A67B434B4A4A09FCB33DB38540A139AC977437ADC2E4A2287C
Magika	rtf
Reporter	abuse_ch
Tags:	CVE-2017-11882 doc

Intelligence

File Origin

# of uploads :

# of downloads :

524

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ad27e25d-600b-4213-a2a3-e49776c9d177

Verdict:

No threats detected

Analysis date:

2025-05-24 23:09:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/ad27e25d-600b-4213-a2a3-e49776c9d177

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Sanesecurity.Malware.28765.RtfHeur.ObjUpd.UNOFFICIAL

Sanesecurity.Shelter.Malware.BadRtf.ObjUpd.UNOFFICIAL

MiscreantPunch.RTF.2017-0199.Obfus.171711.UNOFFICIAL

TwinWave.EvilRTF.ObfusRunAway.20240409.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6832524f44c3881e854cfdf5

Tags:

office xtreme shell

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Searching for synchronization primitives

Launching a process

Creating a window

Sending an HTTP GET request to an infection source by exploiting the app vulnerability

Creating a file in the %AppData% directory

Сreating synchronization primitives

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Launching a service

Connection attempt

Sending an HTTP GET request

Connection attempt to an infection source by exploiting the app vulnerability

Creating a process from a recently created file

Result

Verdict:

Malicious

File Type:

Fake RTF File

Link:

https://app.docguard.net/cc8c9f5b7a3a6d049cdb9a484fb0f39b0cf8d7f73dfc78b495c9580a93363f64/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Malicious

Labled as:

CVE-2017-11882

Link:

https://www.hybrid-analysis.com/sample/cc8c9f5b7a3a6d049cdb9a484fb0f39b0cf8d7f73dfc78b495c9580a93363f64

Gathering data

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1698624

Signature

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/cc8c9f5b7a3a6d049cdb9a484fb0f39b0cf8d7f73dfc78b495c9580a93363f64

Detection:

cve-2017-11882-shellcode

Link:

https://mwdb.cert.pl/sample/cc8c9f5b7a3a6d049cdb9a484fb0f39b0cf8d7f73dfc78b495c9580a93363f64/

Threat name:

Document-OLE.Exploit.CVE-2017-11882

Status:

Malicious

First seen:

2025-05-22 16:01:52 UTC

File Type:

Document

Extracted files:

AV detection:

19 of 37 (51.35%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zsgj6w32hjwqjhg3tjee7mhttmgprv7xhx6hrnevzfmavezwh5sa._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/250524-232nsabl9t/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Verdict:

Suspicious

Tags:

exploit

YARA:

INDICATOR_RTF_EXPLOIT_CVE_2017_11882_1

Link:

https://app.threat.zone/submission/561a7a5c-258d-4d07-b040-d671fb7f7ac8

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cc8c9f5b7a3a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cc8c9f5b7a3a6d049cdb9a484fb0f39b0cf8d7f73dfc78b495c9580a93363f64

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_INDICATOR_RTF_MalVer_Objects Create hunting rule
Author:	ditekSHen
Description:	Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents.
Reference:	https://github.com/ditekshen/detection