MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 faf48d06765f7d2f06362e262f33a2f8db89fe857b39f8697d584e43d8c15325. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Maldoc score: 5

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	faf48d06765f7d2f06362e262f33a2f8db89fe857b39f8697d584e43d8c15325
SHA3-384 hash:	71c0d60aef628052ae280e817288947a18134b129ddfaab14226b787d120b8bf8556320a3de357a3f9db8de4dcedf0a8
SHA1 hash:	7099126ab6d469e203fce750d571c2fd9bba371b
MD5 hash:	3f7d7ee50786368466a7adf7fcaddec7
humanhash:	zebra-low-wyoming-five
File name:	Addendum_01_Roof_Replacement_Fort_St_Jean_Baptiste.docx
Download:	download sample
File size:	34'577 bytes
First seen:	2026-10-10 12:32:03 UTC
Last seen:	Never
File type:	doc
MIME type:	application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep	768:o5O31X1to03Y4hc5zt5VZhQN9tpL81VtEKDk:o5Grto03Yic5BU3tJ81V6KDk
TLSH	T1E0F2AF17E201F833CB2CC47D9C5504FEE79FAA0804629E2DE552936C8D61657AFABC8D
TrID	52.2% (.DOCX) Word Microsoft Office Open XML Format document (23500/1/4) 38.8% (.ZIP) Open Packaging Conventions container (17500/1/4) 8.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	docx
Reporter	Anonymous
Tags:	doc

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 5

File Format is MS Word 2007+

Container Format is OpenXML

Office document contains 1 external relationships (see links below)

Relationship	External Link
hyperlink	https://cleavemornedocs.s3.us-east-005.backblazeb2.com/hseiwulsanfewhchqoreoaoklbwvabdevchbx.html

Embedded Images

MalwareBazaar found the following images embedded in this file:

MD5 hash	dc.creator	# of relations
d6e6fa0c00cab3d4aa1cb669b07114dd	Notice center	None

Intelligence

File Origin

# of uploads :

# of downloads :

190

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

MSO

Details

Link:

https://research.acce.ciphertechsolutions.com/results/91216568-162f-427e-a1a6-5ae9ab88176a/

Malware family:

n/a

ID:

File name:

doc

Verdict:

Suspicious activity

Analysis date:

2026-10-10 12:35:15 UTC

Tags:

doc-url external-template

Link:

https://app.any.run/tasks/c9b2545c-77c8-49de-a553-bac6e13b4e57

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Legit

File type:

application/msword

Has a screenshot:

False

Contains macros:

False

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Creating a window

Сreating synchronization primitives

Launching a service

Result

Verdict:

Clean

File Type:

OOXML Word File

Link:

https://app.docguard.net/faf48d06765f7d2f06362e262f33a2f8db89fe857b39f8697d584e43d8c15325/results/dashboard

Document image

Image:

Download PNG

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/6aca3053f4c3b3b75f5f03e8/reports/515d6799-006b-49a7-b409-722080a9ee26/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/faf48d06765f7d2f06362e262f33a2f8db89fe857b39f8697d584e43d8c15325

Label:

Benign

Suspicious Score:

6/10

Score Malicious:

Score Benign:

93%

Link:

https://www.malware.ai/gui/files/?id=a1c50468-81aa-47da-baea-192b1171369d

Verdict:

Clean

File Type:

docx

Link:

https://opentip.kaspersky.com/faf48d06765f7d2f06362e262f33a2f8db89fe857b39f8697d584e43d8c15325/results?tab=lookup

Score:

99%

Verdict:

Malware

File Type:

OFFICE

Link:

https://malprob.io/report/faf48d06765f7d2f06362e262f33a2f8db89fe857b39f8697d584e43d8c15325

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Office Document

Link:

https://app.malva.re/file/3f7d7ee50786368466a7adf7fcaddec7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/faf48d06765f7d2f06362e262f33a2f8db89fe857b39f8697d584e43d8c15325/

Threat name:

Document.Trojan.Phish

Status:

Malicious

First seen:

2026-10-06 21:07:38 UTC

File Type:

Document

Extracted files:

AV detection:

4 of 24 (16.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7l2i2btwl56s6brwfytc6m5c7dnyt7ufpm47q2l5lbhehwgbkmsq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/261010-pqp31avtex/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MULTI_Malware_Unknown_ForgeAuto_4f67e0b3_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

doc faf48d06765f7d2f06362e262f33a2f8db89fe857b39f8697d584e43d8c15325

(this sample)

Delivery method

Distributed via e-mail attachment

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample