MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f188eec1268fd49bdc7375fc5b77ded657c150875fede1a4d797f818d2514e88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Lazarus

Vendor detections: 5

Maldoc score: 15

Intelligence 5 IOCs YARA File information Comments

SHA256 hash:	f188eec1268fd49bdc7375fc5b77ded657c150875fede1a4d797f818d2514e88
SHA3-384 hash:	eb7d6f039d72ba3f2da1431b8acf5ba31e2c223c967d5de27b714c9232541e2e8f5732601a68031f0b570971cd30b1b4
SHA1 hash:	f675c0aa46a18a6026f0d541fce6a75688a018aa
MD5 hash:	e87b575b2ddfb9d4d692e3b8627e3921
humanhash:	pizza-alanine-queen-uncle
File name:	f188eec1268fd49bdc7375fc5b77ded657c150875fede1a4d797f818d2514e88.bin
Download:	download sample
Signature	Lazarus Create hunting rule
File size:	2'066'432 bytes
First seen:	2021-01-22 19:07:50 UTC
Last seen:	2022-10-05 10:05:55 UTC
File type:	doc
MIME type:	application/msword
ssdeep	24576:qXLERj43LTzR9rrS/7dDXMCcZVZD5Akh2ulzm3f0kPvw3o2QgjUNQNNc9y/oRky+:qXLEqC2J3WA753
TLSH	5AA59C969A0C4AEFD94D00B03B2D7F91B3583C41AFDBCA1F6659A9180D2EF58CF0B945
Reporter	Arkbird_SOLG
Tags:	apt Lazarus maldoc

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 15

Application name is unknown

Office document is in OLE format

Office document contains VBA Macros

OLE dump

MalwareBazaar was able to identify 16 sections in this file using oledump:

Section ID	Section size	Section name
1	114 bytes	CompObj
2	280 bytes	DocumentSummaryInformation
3	340 bytes	SummaryInformation
4	7030 bytes	1Table
5	206129 bytes	Data
6	372 bytes	Macros/PROJECT
7	41 bytes	Macros/PROJECTwm
8	1820911 bytes	Macros/VBA/ThisDocument
9	4109 bytes	Macros/VBA/_VBA_PROJECT
10	514 bytes	Macros/VBA/dir
11	112 bytes	ObjectPool/_1649178531/CompObj
12	16 bytes	ObjectPool/_1649178531/OCXNAME
13	6 bytes	ObjectPool/_1649178531/ObjInfo
14	86 bytes	ObjectPool/_1649178531/f
15	0 bytes	ObjectPool/_1649178531/o
16	4096 bytes	WordDocument

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	Frame1_Layout	Runs when the file is opened and ActiveX objects trigger events
Hex String	R8ItyQ	523849747951
Hex String	Gjqz	476A717A
Hex String	mtSWbE	6D7453576245
Hex String	1oAm	316F416D
Hex String	EROwXn	45524F77586E
Hex String	9xom	39786F6D
Hex String	Qiwfn8	516977666E38
Hex String	j1UV	6A315556
Hex String	tfcNpv	7466634E7076
Hex String	TiA6	54694136
Hex String	weLjJj	77654C6A4A6A
Hex String	66jh	36366A68
Hex String	p5lHH6	70356C484836
Hex String	TGZT	54475A54
Hex String	7PlVJ6	37506C564A36
Hex String	zOQ4	7A4F5134
Hex String	Wwxd	57777864
Hex String	g4RT	67345254
Hex String	66Kjnm	36364B6A6E6D
Hex String	EWAV	45574156
Hex String	WAVA	57415641
Hex String	AUAVA	204155415641
Hex String	AVAT	41564154
Hex String	WAVAW	205741564157
Hex String	Q	510A427D
Hex String	rla_	726C615F
Hex String	O	4F0D2E32
Hex String	NfLN	4E664C4E
Hex String	mtO	6D744F09
Hex String	v	09760B4B
Hex String	y7	79370B25
Hex String	iivr	69697672
Hex String	mTCq-	206D5443712D
Hex String	AT2C	41543243
Hex String	Dg	44670B30
Hex String	.5A	2E35410C
Hex String	YR6	5952360C6561
Hex String	nPPc	6E505063
Hex String	LWIi	4C574969
Hex String	cgXK	6367584B
Hex String	fz-o	667A2D6F
Hex String	hWVS	68575653
Hex String	pCtAOh	704374414F68
Hex String	ieiFrq	696569467271
Hex String	yuTY	79755459
Hex String	Qrb1mP	517262316D50
Hex String	LTcu	4C546375
Hex String	frWXkT	667257586B54
Hex String	vCIN	7643494E
Hex String	jSwLaN	6A53774C614E
Hex String	Mj3S	4D6A3353
Hex String	Z1742p	5A3137343270
Hex String	SE2P	53453250
Hex String	87nJ	38376E4A
Hex String	w981Y7	773938315937
Hex String	APPf	41505066
Hex String	fOg3xB	664F67337842
Hex String	1uA7	31754137
Hex String	SJiujA	534A69756A41
Hex String	YCpE	59437045
Hex String	7M1u7r	374D31753772
Hex String	_3AU	5F334155
Hex String	5	rz
Hex String	tq	74710B52
Hex String	eFfS	65466653
Hex String	gcL9	67634C39
Hex String	m6Jj	6D364A6A
Hex String	g4UX	67345558
Hex String	z31I	7A333149
Hex String	Hm V	486D0956
Hex String	I yQ	49097951
Hex String		Itj
Hex String	tltn	746C746E
Hex String	qkiN	716B694E
Hex String	u.FI	752E4649
Hex String	3A2J	3341324A
Hex String	Ms0F	4D733046
Hex String	.RY	2E525909
Hex String	Twt	5477740B
Hex String	Rdj.	52646A2E
Hex String	Eh9L	4568394C
Hex String	M	4D0A2B0B
Hex String	KV b	4B562062
Hex String	mVJD	6D564A44
Hex String	u	750A2E7C
Hex String	opW 6i	6F7057093669
Hex String	BHgR	42486752
Hex String	g1lm	67316C6D
Hex String	wB-j	77422D6A
Hex String	nVg	0B6E5667
Hex String	6	360D36786932
Hex String	pY6	70593620
Hex String	d0	64300D3B
Hex String	3ww0	33777730
Hex String	WqKP	57714B50
Hex String	ShUH	53685548
Hex String	TBiX	54426958
Hex String	OM6MiE	4F4D364D6945
Hex String	lt	6C740D39
Hex String	klV9	6B6C5639
Hex String	RqC-	5271432D
Hex String	G	470A2A76
Hex String	_pMp	5F704D70
Hex String	HuFN	4875464E
Hex String	x	780A3A3B722F
Hex String	fwH	6677480C
Hex String	4p2E	34703245
Hex String	y	0D790B61
Hex String	-fk8	2D666B38
Hex String	t-Tj	742D546A
Hex String	s7	73370A48
Hex String	NEkQ	4E456B51
Hex String	D	440D096F
Hex String	FYJf	46594A66
Hex String	funz	66756E7A
Hex String	5Hsx	35487378
Hex String	bbNN	62624E4E
Hex String	l	6C0D4839
Hex String	KHu	4B487509
Hex String	5tjZ	35746A5A
Hex String	XW1	58573109
Hex String	7Qdt	37516474
Hex String	Flx	466C780D
Hex String	SB4-	5342342D
Hex String	e_lg	655F6C67
Hex String	5CR-	3543522D
Hex String	mE7V	6D453756
Hex String	Xo	586F0D4D
Hex String	B2H	0C423248
Hex String	Va9Z	5661395A
Hex String	WGY8	57475938
Hex String	ub2r	75623272
Hex String	S	Dm
Hex String	ode	0B6F6465
Hex String	atcu	61746375
Hex String	XJrt	584A7274
Hex String	s7Ww	73375777
Hex String	oP	0B6F500B3334
Hex String	kf	6B660A786809
Hex String	wrG	7772470D
Hex String	yiSS	79695353
Hex String	pY	70590C5D
Hex String	znse	7A6E7365
Hex String	gPTJ	6750544A
Hex String	cS1n	6353316E
Hex String	9-1D	392D3144
Hex String	DFqL	4446714C
Hex String	z 2L	7A20324C
Hex String	g_o	20675F6F
Hex String	4	h1
Hex String	Prny	50726E79
Hex String	p7Rn	7037526E
Hex String	cPV	63505620
Hex String	VCMn	56434D6E
Hex String	iht	0B696874
Hex String	PYyv	50597976
Hex String	by3B	62793342
Hex String	yYY	7959590D
Hex String	wGrg	77477267
Hex String	SURK	5355524B
Hex String	DAK7	44414B37
Hex String	xORd	784F5264
Hex String	Q-M5	512D4D35
Hex String	505a	35303561
Hex String	cE1.	6345312E
Hex String	3f3D	33663344
Hex String	UROz	55524F7A
Suspicious	Open	May open a file
Suspicious	Lib	May run code from a DLL
Suspicious	Chr	May attempt to obfuscate specific strings (use option --deobf to deobfuscate)
Suspicious	Xor	May attempt to obfuscate specific strings (use option --deobf to deobfuscate)
Suspicious	.Variables	May use Word Document Variables to store and hide data
Suspicious	Hex Strings	Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin

# of uploads :

# of downloads :

217

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

NG-Opportunity.doc

Verdict:

Malicious activity

Analysis date:

2021-01-21 21:44:11 UTC

Tags:

macros macros-on-open

Link:

https://app.any.run/tasks/39059fe7-c4a4-42d1-944b-96c447b2d442

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

TwinWave.EvilDoc.XORStaticMathInfiniteRift.20210121.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Result

Threat name:

Unknown

Detection:

malicious

Classification:

expl

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/588812

Signature

Antivirus / Scanner detection for submitted sample

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with base64 encoded strings

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Document exploit detected (process start blacklist hit)

Machine Learning detection for sample

Microsoft Office drops suspicious files

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Office process drops PE file

Sigma detected: Microsoft Office Product Spawning Windows Shell

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f188eec1268fd49bdc7375fc5b77ded657c150875fede1a4d797f818d2514e88/

Threat name:

Script-Macro.Trojan.Stratos

Status:

Malicious

First seen:

2021-01-22 03:17:00 UTC

AV detection:

10 of 28 (35.71%)

Threat level:

5/5

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f188eec1268fd49bdc7375fc5b77ded657c150875fede1a4d797f818d2514e88

File information

The table below shows additional information about this malware sample such as delivery method and external references.

https://twitter.com/_CPResearch_/status/1352310521752662018

Delivery method

Other

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample