MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f3330af910ba83f74deec6ffd26a5401360f0e984678a8fae64cf8f944cbce5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DarkGate
Vendor detections: 7
| SHA256 hash: | f3330af910ba83f74deec6ffd26a5401360f0e984678a8fae64cf8f944cbce5b |
|---|---|
| SHA3-384 hash: | 4812284d95931783d4fccde8e4abb55fa7da3f9b4f53ff1a986e11d883aff15c773049a6af82bc897374c96d8be1dc06 |
| SHA1 hash: | 91c39fbe0ee33855de3b202f9b658eaa8ed70a8e |
| MD5 hash: | bf0f433abcabe437a72b128537680a49 |
| humanhash: | victor-lemon-seventeen-pluto |
| File name: | march-25-2024-7320.xlsx |
| Download: | download sample |
| Signature | DarkGate |
| File size: | 67'582 bytes |
| First seen: | 2024-03-25 20:52:14 UTC |
| Last seen: | 2024-03-25 22:27:13 UTC |
| File type: |  xlsx |
| MIME type: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
| ssdeep | 1536:C2i3OnslDGe2eGyIvJhaaO5Ny4iUvRB75d/wSgE9pgyjxOqTY:C3Osj4yIRAzHiE/7n/tgE9pgyjxC |
| TLSH | T12D6302EBF17E5902D7727036584A21E6355BA03CE526FA590806BBDE87C042733E47AF |
| TrID | 60.1% (.XLSX) Excel Microsoft Office Open XML Format document (34000/1/7) 30.9% (.ZIP) Open Packaging Conventions container (17500/1/4) 7.0% (.ZIP) ZIP compressed archive (4000/1) 1.7% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1) |
| Reporter |  k3dg3___ |
| Tags: | admin888 DarkGate newxls25 xlsx |
Intelligence
File Origin
# of uploads :
2
# of downloads :
2'485
Origin country :
USVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f3330af910ba83f74deec6ffd26a5401360f0e984678a8fae64cf8f944cbce5b.xlsx
Verdict:
No threats detected
Analysis date:
2024-03-25 20:52:46 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Changing an executable file
Using the Windows Management Instrumentation requests
Creating a window
Сreating synchronization primitives
Launching a process
Moving a file to the Program Files subdirectory
Replacing files
Infecting executable files
Result
Verdict:
Suspicious
File Type:
OOXML Excel File
Behaviour
BlacklistAPI detected
Document image
Image:
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
explorer lolbin
Gathering data
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.expl
Score:
56 / 100
Signature
Detected suspicious Microsoft Office reference URL
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Opens network shares
Behaviour
Behavior Graph:
Threat name:
Document-Office.Trojan.Malgent
Status:
Malicious
First seen:
2024-03-25 20:53:06 UTC
File Type:
Document
Extracted files:
14
AV detection:
7 of 24 (29.17%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
vbs Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.