MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f552b727c2ea726bf41810bb5f5d2121b13f426ec0cb23201d4f8a9ce8f5fd47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f552b727c2ea726bf41810bb5f5d2121b13f426ec0cb23201d4f8a9ce8f5fd47
SHA3-384 hash:	83f2cdc851e0acb24d885499b4c5b181f0049627adb70bc6d8b8140252543c5adde829c7f9019a20d611c02e1e4dcc2d
SHA1 hash:	7447b36ebed6fbce8c93ba7f4d7a426e96b8fda0
MD5 hash:	08c6875bc81611e2ca718c13cb243d65
humanhash:	apart-finch-oxygen-twenty
File name:	payment070388974.xlsb
Download:	download sample
Signature	Dridex Alert Create hunting rule
File size:	83'934 bytes
First seen:	2021-11-26 12:51:43 UTC
Last seen:	2021-12-06 14:54:57 UTC
File type:	xlsx
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	1536:UWFPZZKz/1eCzbqzLkh/OPvTFVuVKqHEA1rdnkjU7AxwYUYVgdV:VXEz/9qGWPvZVuVK6EXo7Ax5USgdV
TLSH	T17E83029DCA5C95BBC666E43B024F297AAD1585F06480E3AF54B8F20C11F2783734DA1F
Reporter	TeamDreier
Tags:	Dridex xlsx

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

183

Origin country :

n/a

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

payment070388974.xlsb

Verdict:

No threats detected

Analysis date:

2021-11-26 12:57:10 UTC

Tags:

macros40

Link:

https://app.any.run/tasks/8a12cfd6-cfd8-48a0-b588-602366878b5b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

BitDam Malicious

Verdict:

Malicious

File type:

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

Has a screenshot:

False

Contains macros:

False

ClamAV Detected

Detection(s):

TwinWave.EvilDoc.XL4MQakyEsqHomeComing.20210426.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.XL4MDridexYourStringShilouette.20211102.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.XL4MDridexRunningDownTheDream.20211115.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.DridexAndTheFuriousFiveMessage.20211124.UNOFFICIAL

Alert

Create hunting rule

securiteinfo.com.xls4.icedid.42146.5256.5371.UNOFFICIAL

Alert

Create hunting rule

securiteinfo.com.xls4.icedid.42146.23809.575.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

DNS request

Creating a window

Сreating synchronization primitives

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

OOXML Excel File with Excel4Macro

Link:

https://app.docguard.net/f552b727c2ea726bf41810bb5f5d2121b13f426ec0cb23201d4f8a9ce8f5fd47/results/dashboard

Document image

Image:

Download PNG

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

mshta

Link:

https://www.filescan.io/uploads/61a0d87ef36138de3f3ef5fc/reports/230e1b01-7ff8-49a2-9c22-0a6a5a98ad7b/overview

Joe Sandbox Dridex Downloader

Result

Threat name:

Dridex Downloader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/896729

Signature

Contains functionality to create processes via WMI

Creates and opens a fake document (probably a fake document to hide exploiting)

Creates processes via WMI

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Multi AV Scanner detection for submitted file

Sigma detected: Microsoft Office Product Spawning Windows Shell

Sigma detected: Suspicious MSHTA Process Patterns

Sigma detected: TA505 Dropper Load Pattern

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Dridex Downloader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f552b727c2ea726bf41810bb5f5d2121b13f426ec0cb23201d4f8a9ce8f5fd47/

ReversingLabs TitaniumCloud Document-Excel.Infostealer.Dridex

Threat name:

Document-Excel.Infostealer.Dridex

Alert

Create hunting rule

Status:

Malicious

First seen:

2021-11-26 12:52:28 UTC

File Type:

Document

Extracted files:

24

AV detection:

17 of 27 (62.96%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6vjloj6c5jzgx5aycc5v6xjbegyt6qtoydfsgia5j6fjz2hv7vdq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

macro xlm

Link:

https://tria.ge/reports/211126-p33jvscdbj/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f552b727c2ea726bf41810bb5f5d2121b13f426ec0cb23201d4f8a9ce8f5fd47