MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc00199b1dbd357977319b8bc50f064f0e4f6db735d12e1a45e4c179ae200858. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fc00199b1dbd357977319b8bc50f064f0e4f6db735d12e1a45e4c179ae200858
SHA3-384 hash:	fdb9b56a91072ea023449dceaa6a877a6d9abf20d6d7784264577807575b1f259652d21fc2e41a3aaca498dd41f5c9c3
SHA1 hash:	14e65d89365b0a92750c0de4110c9723db415c93
MD5 hash:	713002af1f5c46201fdbbf04ae4cbdbc
humanhash:	montana-stream-football-sink
File name:	Mt103Memo.zip
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	28'895 bytes
First seen:	2024-05-02 07:18:46 UTC
Last seen:	2024-05-02 08:04:16 UTC
File type:	zip
MIME type:	application/zip
ssdeep	768:eSwQJ+v+TUFUIeNUJDFiZx+UgVgv+7/Gx8d:e/QJ+mMUIeNUyZxJgVg6exa
TLSH	T1FAD2E14F28DD9679B75A45E33D12553A331B65201A62D2D91808C884C3FB2B7FF5B0A6
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	CVE-2017-11882 FormBook zip

cocaman

Malicious email (T1566.001)
From: "Finance01 allsport.ch <finance01@kdsports.store>" (likely spoofed)
Received: "from rdns0.kdsports.store (kdsports.store [5.149.248.223]) "
Date: "02 May 2024 01:03:08 -0700"
Subject: "Fw: MT103 Failed /Returned"
Attachment: "Mt103Memo.zip"

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

357

Origin country :

CH

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.29015.RtfHeur.Msg.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Exploit.CVE-2018-0798.4.521.12040.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Shelter.Malware.BadRtf.ObjUpd.UNOFFICIAL

Alert

Create hunting rule

MiscreantPunch.EvilRTF.CommonLure.UNOFFICIAL

Alert

Create hunting rule

MiscreantPunch.RTF.2017-0199.Obfus.171711.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.RoomService.20230808.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

Fake RTF File

Link:

https://app.docguard.net/fc00199b1dbd357977319b8bc50f064f0e4f6db735d12e1a45e4c179ae200858/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/66333e6aca951b85945b02d7/reports/973852cf-47a7-4d92-91ca-11bf2a479800/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fc00199b1dbd357977319b8bc50f064f0e4f6db735d12e1a45e4c179ae200858

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fc00199b1dbd357977319b8bc50f064f0e4f6db735d12e1a45e4c179ae200858/

ReversingLabs TitaniumCloud Document-Office.Exploit.CVE-2017-11882

Threat name:

Document-Office.Exploit.CVE-2017-11882

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-05-02 06:42:10 UTC

File Type:

Binary (Archive)

Extracted files:

4

AV detection:

16 of 24 (66.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7qabtgy5xu2xs5zrtof4kdygj4he63nxgxis4gsf4taxtlrabbma._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/240502-ja9jtacc9s/

Behaviour

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks processor information in registry

Enumerates system info in registry

Launches Equation Editor

Office loads VBA resources, possible macro or embedded object present

Drops file in Windows directory

Suspicious use of SetThreadContext

Process spawned suspicious child process

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fc00199b1dbd357977319b8bc50f064f0e4f6db735d12e1a45e4c179ae200858