🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6063921e36b12414d769eda7cf5715541d149e54168128ceeb800a05f9f2b3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 6


Maldoc score: 2


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6063921e36b12414d769eda7cf5715541d149e54168128ceeb800a05f9f2b3d
SHA3-384 hash: 89da99338333072fbca6dc2f68d87bdcf5148665829747bc06f58b2701839e1f2d95e9a03c36ae16abb5826d078144ed
SHA1 hash: bc2d2d2c559395f29835876a196b96b7f5763561
MD5 hash: 5c78e4a9ca8178621432bec41dfe82ce
humanhash: beer-spring-minnesota-cardinal
File name:Order-3899.xls
Download: download sample
Signature ZLoader
Create hunting rule
File size:33'280 bytes
First seen:2020-12-11 14:03:29 UTC
Last seen:2020-12-11 15:37:38 UTC
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 768:MPsk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJGWNkna01y:Ysk3hbdlylKsgqopeJBWhZFGkE+cL2N6
TLSH 47E24FE7F3D5AC45CD59437A48AB87A07723FC221B57838B2285F7292F72AC0494355B
Reporter ffforward
Tags:xls ZLoader

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 2
Application name is Microsoft Excel
Office document is in OLE format
OLE dump

MalwareBazaar was able to identify 3 sections in this file using oledump:

Section IDSection sizeSection name
14096 bytesDocumentSummaryInformation
24096 bytesSummaryInformation
323425 bytesWorkbook
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
2
# of downloads :
295
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Order-3899.xls
Verdict:
No threats detected
Analysis date:
2020-12-11 14:04:35 UTC
Tags:
macros macros40
Link:
https://app.any.run/tasks/7bc94204-1362-4a9d-be4d-71e27685af09

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
TwinWave.EvilDoc.Zloader.ComfortablyNumb.M2.20201208.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Result
Verdict:
Malicious
File Type:
Legacy Office File
Link:
https://app.docguard.net/d6063921e36b12414d769eda7cf5715541d149e54168128ceeb800a05f9f2b3d/results/dashboard
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/561503
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6063921e36b12414d769eda7cf5715541d149e54168128ceeb800a05f9f2b3d/
Threat name:
Document-Word.Downloader.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-12-11 14:04:06 UTC
AV detection:
4 of 29 (13.79%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2yddsipdnmjectlwt3nhz5lrkva5cspfifubfdhoxaakax47fm6q._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro
Link:
https://tria.ge/reports/201211-7b5pp39k3x/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Checks processor information in registry
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
ZLoader
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d6063921e36b12414d769eda7cf5715541d149e54168128ceeb800a05f9f2b3d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ZLoader

Excel file xls d6063921e36b12414d769eda7cf5715541d149e54168128ceeb800a05f9f2b3d

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments