MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa8f807eaf7f442b57db4f7dec9666184cbcc65d0df0e17526f184ab724ab82b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fa8f807eaf7f442b57db4f7dec9666184cbcc65d0df0e17526f184ab724ab82b
SHA3-384 hash:	de2c0a4a7aea7d3aa3c42d53a82915e272b95fcead3cc5b5b6dd67c608bffc5ace57b200d99181752fa9191666e5ee0c
SHA1 hash:	ddd745506a83df003247825ea94e4584cb98504c
MD5 hash:	9be0075b9344590b3cabf61c194db180
humanhash:	don-robert-alanine-georgia
File name:	Rapid Change of Stablecoin (Protected).docx
Download:	download sample
File size:	2'711'508 bytes
First seen:	2021-09-11 06:10:55 UTC
Last seen:	Never
File type:	docx
MIME type:	application/octet-stream
ssdeep	49152:WLcFq4zYkNMDoLNE2h2OSzwz/3vuDk9/MA83fyuUyAIKwgo5/BV:gcPbxPhrSsz/339x83fZU6P5V
TLSH	T177C533F1D9493079D5EB663F393D6D85387E24CB9F408A1F3A19A3104821EDB6A87F18
Reporter	JAMESWT_WT
Tags:	docx

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

346

Origin country :

n/a

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Rapid Change of Stablecoin (Protected).docx

Verdict:

Malicious activity

Analysis date:

2021-09-11 06:11:27 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/fcf5f9e0-44ec-4ebc-8b60-2b094cdafc44

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

BitDam Legit

Verdict:

Legit

File type:

application/vnd.openxmlformats-officedocument.wordprocessingml.document

Has a screenshot:

False

Contains macros:

False

ClamAV Detected

Detection(s):

MiscreantPunch.Suspicious.RemoteTemplateCall.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

OOXML Word File

Link:

https://app.docguard.net/fa8f807eaf7f442b57db4f7dec9666184cbcc65d0df0e17526f184ab724ab82b/results/dashboard

Payload URLs

URL

File name

https://twitter.com/Libra_/status/1250786192502685696

document.xml

Document image

Image:

Download PNG

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/849079

Signature

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fa8f807eaf7f442b57db4f7dec9666184cbcc65d0df0e17526f184ab724ab82b/

ReversingLabs TitaniumCloud Document-Office.Downloader.Dotmer

Threat name:

Document-Office.Downloader.Dotmer

Alert

Create hunting rule

Status:

Malicious

First seen:

2021-09-09 03:30:21 UTC

File Type:

Document

Extracted files:

60

AV detection:

2 of 45 (4.44%)

Threat level:

  3/5

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/210911-gxl1xsbah4/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Office loads VBA resources, possible macro or embedded object present

Drops file in Windows directory

Abuses OpenXML format to download file from external location

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fa8f807eaf7f442b57db4f7dec9666184cbcc65d0df0e17526f184ab724ab82b