MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5a335ee24fa41b3fa92c6ea5bece9322f2fd375136a1575673ca2abe323f24d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SilentBuilder


Vendor detections: 12


Maldoc score: 3


Intelligence 12 IOCs YARA 6 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f5a335ee24fa41b3fa92c6ea5bece9322f2fd375136a1575673ca2abe323f24d
SHA3-384 hash: e315664e2228cf3c16bceb0128161cf25caf978e3b9a2b45d6d5eab0f7d4e6381a088cfab9faed8ba5a2dfbe10721c52
SHA1 hash: 59cd337ed4d909f34cb611e195506de67778b1a5
MD5 hash: 7ab03924eff46a3eecf296527931c952
humanhash: october-cola-salami-crazy
File name:7ab03924eff46a3eecf296527931c952
Download: download sample
Signature SilentBuilder
Create hunting rule
File size:66'695 bytes
First seen:2021-12-23 06:13:57 UTC
Last seen:Never
File type:Excel file xlsx
MIME type:application/vnd.ms-excel
ssdeep 1536:d0Nk3hbdlylKsgqopeJBWhZFGkE+cL2NdAKzMk9B+ooszMk9A+oos:dak3hbdlylKsgqopeJBWhZFGkE+cL2NP
TLSH T13A535C56BB87998EDA4213358CE74359B337FC168BA7C7473554B3294EB4AE08C03A1B
Reporter zbetcheckin
Tags:excel SilentBuilder xlsx

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 3
OLE dump

MalwareBazaar was able to identify 3 sections in this file using oledump:

Section IDSection sizeSection name
14096 bytesDocumentSummaryInformation
24096 bytesSummaryInformation
352228 bytesWorkbook
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecAuto_OpenRuns when the Excel Workbook is opened
IOC87.251.86.178IPv4 address
SuspiciousXLM macroXLM macro found. It may contain malicious code

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7ab03924eff46a3eecf296527931c952
Verdict:
Malicious activity
Analysis date:
2021-12-23 06:16:21 UTC
Tags:
macros macros40 trojan loader
Link:
https://app.any.run/tasks/c9afab1d-7729-43c6-ba06-1b418db77d2e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
Has a screenshot:
False
Contains macros:
False
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/215879/
Detection(s):
TwinWave.EvilDoc.DOCXRSTRGOOD.MSHTA.210816.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.HiddenSheetExcel4LureRecognizer.20200915.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.Excel4MacroLuresWatchingTheDectives.20210115.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.Excel4DragoTrainingMontage.20210204.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.Excel4HateMeSometimes.20210819.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOODXL4.HTTP
Create hunting rule

TwinWave.EvilDoc.DridexUManiac.20211215.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Sending a custom TCP request
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Launching a process
Sending an HTTP GET request
Running batch commands by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
Legacy Excel File
Link:
https://app.docguard.net/f5a335ee24fa41b3fa92c6ea5bece9322f2fd375136a1575673ca2abe323f24d/results/dashboard
Payload URLs
URL
File name
87.251.86.178
WorkBook
Document image
Image:
Download PNG
Document image
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd macros macros-on-open mshta stripped
Link:
https://www.filescan.io/uploads/61c413ae8991ba72b3933330/reports/e2c25011-87e3-4d55-ae21-2244115043b0/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/f5a335ee24fa41b3fa92c6ea5bece9322f2fd375136a1575673ca2abe323f24d
Details
Excel 4.0 Macro
Document contains Excel 4.0 macros (XLM). A valid, albeit dated feature, this document should be treated with suspicion.
Macro Execution Coercion
Detected a document that appears to social engineer the user into activating embedded logic.
Autostarting Excel Macro Sheet
Excel contains Macrosheet logic that will trigger automatically upon document open.
Document With Minimal Content
Document contains less than 1 kilobyte of semantic information.
Result
Threat name:
Hidden Macro 4.0 Emotet
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/911855
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found malware configuration
Multi AV Scanner detection for submitted file
Obfuscated command line found
Powershell drops PE file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: MSHTA Spawning Windows Shell
Sigma detected: Suspicious MSHTA Process Patterns
Sigma detected: Suspicious PowerShell Command Line
Tries to detect virtualization through RDTSC time measurements
Yara detected Emotet
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 544333 Sample: pWJfDEJOvA Startdate: 23/12/2021 Architecture: WINDOWS Score: 100 36 45.15.23.184 VIRTONO-NETWORKSRO Romania 2->36 38 162.214.50.39 UNIFIEDLAYER-AS-1US United States 2->38 40 30 other IPs or domains 2->40 44 Found malware configuration 2->44 46 Antivirus detection for URL or domain 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 10 other signatures 2->50 12 EXCEL.EXE 7 10 2->12         started        signatures3 process4 signatures5 56 Obfuscated command line found 12->56 15 cmd.exe 12->15         started        process6 process7 17 mshta.exe 11 15->17         started        dnsIp8 34 87.251.86.178, 49167, 49168, 80 GALAXYDATARU Russian Federation 17->34 20 powershell.exe 12 7 17->20         started        process9 dnsIp10 42 www.catholicroundup.com 157.245.119.201, 49169, 80 DIGITALOCEAN-ASNUS United States 20->42 32 C:\Users\Public\Documents\ssd.dll, PE32 20->32 dropped 52 Powershell drops PE file 20->52 25 cmd.exe 20->25         started        file11 signatures12 process13 process14 27 rundll32.exe 25->27         started        signatures15 54 Tries to detect virtualization through RDTSC time measurements 27->54 30 rundll32.exe 27->30         started        process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f5a335ee24fa41b3fa92c6ea5bece9322f2fd375136a1575673ca2abe323f24d/
Threat name:
Document-Excel.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2021-12-23 06:14:10 UTC
File Type:
Document
Extracted files:
10
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6wrtl3re7ja3h6usy3vfx3hjgixs7u3vcnvbk5lhhsrkxyzd6jgq._file
Result
Malware family:
emotet
Create hunting rule
Score:
  10/10
Tags:
family:emotet botnet:epoch4 banker macro trojan xlm
Link:
https://tria.ge/reports/211223-gzbyqshbb8/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in System32 directory
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Emotet
Process spawned unexpected child process
Malware Config
C2 Extraction:
54.37.212.235:80
45.15.23.184:443
41.76.108.46:8080
212.237.5.209:443
46.55.222.11:443
207.38.84.195:8080
103.8.26.102:8080
138.185.72.26:8080
104.251.214.46:8080
110.232.117.186:8080
51.68.175.8:8080
176.104.106.96:8080
216.158.226.206:443
103.8.26.103:8080
103.75.201.2:443
210.57.217.132:8080
195.154.133.20:443
45.142.114.231:8080
107.182.225.142:8080
158.69.222.101:443
45.118.115.99:8080
192.254.71.210:443
178.79.147.66:8080
203.114.109.124:443
212.237.56.116:7080
173.212.193.249:8080
58.227.42.236:80
50.116.54.215:443
162.214.50.39:7080
45.118.135.203:7080
212.237.17.99:8080
81.0.236.90:443
Dropper Extraction:
http://87.251.86.178/pp/oo.html
http://87.251.86.178/pp/PP.PNG
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/f5a335ee24fa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f5a335ee24fa41b3fa92c6ea5bece9322f2fd375136a1575673ca2abe323f24d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Excel_Hidden_Macro_Sheet
Create hunting rule
Rule name:Excel_Hidden_Macro_Sheet
Create hunting rule
Rule name:INDICATOR_DOC_PhishingPatterns
Create hunting rule
Author:ditekSHen
Description:Detects OLE, RTF, PDF and OOXML (decompressed) documents with common phishing strings
Rule name:SUSP_EnableContent_String_Gen
Create hunting rule
Author:Florian Roth
Description:Detects suspicious string that asks to enable active content in Office Doc
Reference:Internal Research
Rule name:SUSP_EnableContent_String_Gen_RID322C
Create hunting rule
Author:Florian Roth
Description:Detects suspicious string that asks to enable active content in Office Doc
Reference:Internal Research
Rule name:SUSP_Excel4Macro_AutoOpen
Create hunting rule
Author:John Lambert @JohnLaTwC
Description:Detects Excel4 macro use with auto open / close

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SilentBuilder

Excel file xlsx f5a335ee24fa41b3fa92c6ea5bece9322f2fd375136a1575673ca2abe323f24d

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1912470/
  
URLhaus
https://urlhaus.abuse.ch/url/1912906/
  
URLhaus
https://urlhaus.abuse.ch/url/1912797/
Cape
Cape
https://www.capesandbox.com/analysis/215879/
  
URLhaus
https://urlhaus.abuse.ch/url/1913907/

Comments


Avatar
zbet commented on 2021-12-23 06:13:58 UTC

url : hxxps://www.tenpin.gr/Rousseau/OBUzVYnbjeLJfamxaOqX0GMJeh/