MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef7d2d906abd5e0376f3dccd9cd0bfa6e1e2d8aa08cb86e97ea02d3ab6b9e1f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 11


Maldoc score: 12


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef7d2d906abd5e0376f3dccd9cd0bfa6e1e2d8aa08cb86e97ea02d3ab6b9e1f6
SHA3-384 hash: b27359ae38a11b8b50fd69cd9fb69ae810312b62153ab86077d49ba28f12a51c2c17896b982f7c2bce093a1987b38b92
SHA1 hash: eaf00304b49f0a26dbc8bc53890bbe3e3bed3dc7
MD5 hash: 3e7080a698232bd987d162608611e3e6
humanhash: orange-september-texas-speaker
File name:PO 07397693 AUGUST.xls
Download: download sample
Signature NetWire
Create hunting rule
File size:131'584 bytes
First seen:2022-10-03 07:53:34 UTC
Last seen:Never
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 3072:5k3hOdsylKlgryzc4bNhZFGzE+cL2knAo9pWkmanzr0O8ZFKdshErlsD:5k3hOdsylKlgryzc4bNhZF+E+W2knAoA
TLSH T1AED3F913AC59859BD31803B6BC9B6FFC2B1A5F09A84767FF21917F9A3E752004D8B019
TrID 46.5% (.XLS) Microsoft Excel sheet (alternate) (56500/1/4)
26.7% (.XLS) Microsoft Excel sheet (32500/1/3)
20.1% (.XLS) Microsoft Excel sheet (alternate) (24500/1/2)
6.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter abuse_ch
Tags:NetWire xls

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 12
OLE dump

MalwareBazaar was able to identify 15 sections in this file using oledump:

Section IDSection sizeSection name
1107 bytesCompObj
2244 bytesDocumentSummaryInformation
3224 bytesSummaryInformation
483978 bytesWorkbook
5470 bytes_VBA_PROJECT_CUR/PROJECT
686 bytes_VBA_PROJECT_CUR/PROJECTwm
732284 bytes_VBA_PROJECT_CUR/VBA/Module1
8977 bytes_VBA_PROJECT_CUR/VBA/Sheet1
9985 bytes_VBA_PROJECT_CUR/VBA/ThisWorkbook
102965 bytes_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
111255 bytes_VBA_PROJECT_CUR/VBA/__SRP_0
12122 bytes_VBA_PROJECT_CUR/VBA/__SRP_1
13154 bytes_VBA_PROJECT_CUR/VBA/__SRP_2
14434 bytes_VBA_PROJECT_CUR/VBA/__SRP_3
15568 bytes_VBA_PROJECT_CUR/VBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecAutoOpenRuns when the Word document is opened
AutoExecAuto_OpenRuns when the Excel Workbook is opened
SuspiciousShellMay run an executable file or a system command
SuspiciousvbHideMay run an executable file or a system command
SuspiciousChrMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
244
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/315980/
Detection(s):
TwinWave.EvilDoc.DOCXSTRGOOD.//
Create hunting rule

TwinWave.EvilDoc.StringBuidlersEveryRoseHasItsThorn.20210308.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.TakeMeHomeTonight.20210923.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Office.Macro-13.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.SPTTH.210526.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.OutRunThis.20220121.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Creating a process from a recently created file
Running batch commands
Running batch commands by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
Legacy Excel File with Macro
Link:
https://app.docguard.net/ef7d2d906abd5e0376f3dccd9cd0bfa6e1e2d8aa08cb86e97ea02d3ab6b9e1f6/results/dashboard
Behaviour
BlacklistAPI detected
Document image
Image:
Download PNG
Document image
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
certutil certutil.exe cmd cmd.exe macros macros-on-open packed timeout wscript
Link:
https://www.filescan.io/uploads/633a951ddace43a378f41b4a/reports/68b47173-cc9e-4f99-80dd-3d8b5cc6a6a8/overview
Label:
Malicious
Suspicious Score:
8.0/10
Score Malicious:
8%
Score Benign:
2%
Link:
https://www.malware.ai/gui/files/?id=a5e94c6d-b204-43ed-b3e0-bfe2ead976a8
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/ef7d2d906abd5e0376f3dccd9cd0bfa6e1e2d8aa08cb86e97ea02d3ab6b9e1f6
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
Macro with Hidden Shell
The VBA Shell() command is leveraged by this macro with a window style of '0' or 'vbHide'.
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1082388
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Command shell drops VBS files
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA with many randomly named variables
Document contains an embedded VBA with many string operations indicating source code obfuscation
Document exploit detected (process start blacklist hit)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 714950 Sample: PO 07397693 AUGUST.xls Startdate: 03/10/2022 Architecture: WINDOWS Score: 100 71 Snort IDS alert for network traffic 2->71 73 Malicious sample detected (through community Yara rule) 2->73 75 Antivirus detection for URL or domain 2->75 77 14 other signatures 2->77 12 EXCEL.EXE 53 13 2->12         started        process3 file4 51 C:\Users\user\...\PO 07397693 AUGUST.xls, Composite 12->51 dropped 15 cmd.exe 2 12->15         started        process5 file6 63 C:\Users\user\AppData\Local\Temp\script.vbs, ASCII 15->63 dropped 69 Command shell drops VBS files 15->69 19 wscript.exe 1 15->19         started        21 timeout.exe 15->21         started        23 timeout.exe 15->23         started        signatures7 process8 process9 25 cmd.exe 19->25         started        27 cmd.exe 19->27         started        process10 29 bin.exe 1 8 25->29         started        33 certutil.exe 14 27->33         started        dnsIp11 53 C:\Users\user\AppData\...\pgzBzcEDZDX.exe, PE32 29->53 dropped 55 C:\Users\user\AppData\Local\...\tmp200F.tmp, XML 29->55 dropped 83 Multi AV Scanner detection for dropped file 29->83 85 Machine Learning detection for dropped file 29->85 87 Uses schtasks.exe or at.exe to add and modify task schedules 29->87 89 Injects a PE file into a foreign processes 29->89 36 bin.exe 3 29->36         started        39 schtasks.exe 29->39         started        65 justclickam.com 198.54.114.131, 443, 49173, 49174 NAMECHEAP-NETUS United States 33->65 57 C:\Users\user\AppData\Local\Temp\bin.exe, PE32 33->57 dropped 59 C:\Users\user\AppData\...\PO%20059420[1].exe, PE32 33->59 dropped 61 C:\Users\...\22BAA0AA023E38BC938393490A5774A0, PE32 33->61 dropped 91 System process connects to network (likely due to code injection or exploit) 33->91 file12 signatures13 process14 file15 49 C:\Users\user\AppData\Roaming\...\Host.exe, PE32 36->49 dropped 41 Host.exe 2 36->41         started        process16 signatures17 79 Machine Learning detection for dropped file 41->79 81 Injects a PE file into a foreign processes 41->81 44 Host.exe 41->44         started        47 schtasks.exe 41->47         started        process18 dnsIp19 67 37.0.14.206, 3384, 49175, 49176 WKD-ASIE Netherlands 44->67
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef7d2d906abd5e0376f3dccd9cd0bfa6e1e2d8aa08cb86e97ea02d3ab6b9e1f6/
Threat name:
Win32.Trojan.Valyria
Create hunting rule
Status:
Malicious
First seen:
2022-10-03 07:54:09 UTC
File Type:
Document
Extracted files:
20
AV detection:
13 of 26 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=556s3edkxvpag5xt3tgzzuf7u3q6fwfkbdfyn2l6uawtvnvz4h3a._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
macro macro_on_action
Link:
https://tria.ge/reports/221003-jrjpqafean/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
Process spawned unexpected child process
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d8555e8a-23a9-4886-bd65-9fdc1e3aa6d1
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ef7d2d906abd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ef7d2d906abd5e0376f3dccd9cd0bfa6e1e2d8aa08cb86e97ea02d3ab6b9e1f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/315980/

Comments