Overview
overview
10Static
static
10virusshare...87.exe
windows10-2004-x64
1virusshare...4d.exe
windows10-2004-x64
5virusshare...c9.xls
windows10-2004-x64
10virusshare...f9.doc
windows10-2004-x64
10virusshare...30.pdf
windows10-2004-x64
3virusshare...re.exe
windows10-2004-x64
1virusshare...8d.exe
windows10-2004-x64
3virusshare...fa.exe
windows10-2004-x64
3virusshare...c8.doc
windows10-2004-x64
10virusshare...03.doc
windows10-2004-x64
1virusshare...40.pdf
windows10-2004-x64
3virusshare...ng.apk
android-9-x86
virusshare...ng.apk
android-10-x64
virusshare...ng.apk
android-11-x64
virusshare...4e.doc
windows10-2004-x64
1virusshare...cd.pdf
windows10-2004-x64
3virusshare...7b.exe
windows10-2004-x64
10virusshare...82.exe
windows10-2004-x64
3virusshare...6f.doc
windows10-2004-x64
10virusshare...ry.apk
android-9-x86
virusshare...ry.apk
android-10-x64
virusshare...ry.apk
android-11-x64
virusshare...d2.doc
windows10-2004-x64
1virusshare...1d.exe
windows10-2004-x64
Analysis
-
max time kernel
134s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system -
submitted
14/04/2025, 13:48
Static task
static1
Behavioral task
behavioral1
Sample
virusshare/1/VirusShare_0a2d1ecedf3f79754aa2c18d62e75287.exe
Resource
win10v2004-20250410-en
Behavioral task
behavioral2
Sample
virusshare/1/VirusShare_0aee78510c46e3a200b6bc21ac1c954d.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral3
Sample
virusshare/1/VirusShare_0fea640a7da27f365b3675f73626b9c9.xls
Resource
win10v2004-20250314-en
Behavioral task
behavioral4
Sample
virusshare/1/VirusShare_1ba8249d8503c0cf7bc125588c43bef9.doc
Resource
win10v2004-20250410-en
Behavioral task
behavioral5
Sample
virusshare/1/VirusShare_3cd9a967b67fe69351e390195ca7a430.pdf
Resource
win10v2004-20250410-en
Behavioral task
behavioral6
Sample
virusshare/1/malware.exe
Resource
win10v2004-20250410-en
Behavioral task
behavioral7
Sample
virusshare/2/VirusShare_01b55404de50bd1a56343b2f316ff88d.exe
Resource
win10v2004-20250410-en
Behavioral task
behavioral8
Sample
virusshare/2/VirusShare_1ad9a67240d5775395c45b64dd6529fa.exe
Resource
win10v2004-20250410-en
Behavioral task
behavioral9
Sample
virusshare/2/VirusShare_2fe5b00079aec2d8369a798230313ec8.doc
Resource
win10v2004-20250314-en
Behavioral task
behavioral10
Sample
virusshare/2/VirusShare_3f0b1eed4b7b9ae05fab4d949843f103.doc
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
virusshare/2/VirusShare_480ef02bb062a57724e1b3e14532a140.pdf
Resource
win10v2004-20250314-en
Behavioral task
behavioral12
Sample
virusshare/2/wedding.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral13
Sample
virusshare/2/wedding.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral14
Sample
virusshare/2/wedding.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral15
Sample
virusshare/3/VirusShare_3fb34964fa7b8c6bfad8d960380ff04e.doc
Resource
win10v2004-20250314-en
Behavioral task
behavioral16
Sample
virusshare/3/VirusShare_4675e87be15585e66b0c88b833dd9ecd.pdf
Resource
win10v2004-20250410-en
Behavioral task
behavioral17
Sample
virusshare/3/VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
Resource
win10v2004-20250410-en
Behavioral task
behavioral18
Sample
virusshare/3/VirusShare_5c8b670c503455baafbff400a446cf82.exe
Resource
win10v2004-20250410-en
Behavioral task
behavioral19
Sample
virusshare/3/VirusShare_6ad036ba93c94d6976e2d93c7a3aec6f.doc
Resource
win10v2004-20250314-en
Behavioral task
behavioral20
Sample
virusshare/3/delivery.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral21
Sample
virusshare/3/delivery.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral22
Sample
virusshare/3/delivery.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral23
Sample
virusshare/4/VirusShare_4b8eb7fe75f72c1c5c1f80af9cd165d2.doc
Resource
win10v2004-20250410-en
Behavioral task
behavioral24
Sample
virusshare/4/VirusShare_6d2d7d94fe5faab76b3e786e7d810c1d.exe
Resource
win10v2004-20250314-en
General
-
Target
virusshare/4/VirusShare_4b8eb7fe75f72c1c5c1f80af9cd165d2.doc
-
Size
64KB
-
MD5
4b8eb7fe75f72c1c5c1f80af9cd165d2
-
SHA1
b227eb90323259f6ff11e0436ba03ebd97706e99
-
SHA256
55dd85b37566755ea1ffb022030b413d2722120067abd9b298a89a61f4b790c2
-
SHA512
6a64a0c2d1c9f825aca460c692b96cf40ab511d81ee3d56f52870fe5648d902d6a3ac6c70cc85c4d86bd6b51a1d72373c75635731b2f354f8b541a7727f4e8fd
-
SSDEEP
1536:LYg6BQIewyy7WxIAGWdw3/WEjMTrP4yyh+A4u7sUjl:t6BQhwAxIbp3XOS
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2364 WINWORD.EXE 2364 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 2364 WINWORD.EXE 2364 WINWORD.EXE 2364 WINWORD.EXE 2364 WINWORD.EXE 2364 WINWORD.EXE 2364 WINWORD.EXE 2364 WINWORD.EXE 2364 WINWORD.EXE 2364 WINWORD.EXE 2364 WINWORD.EXE 2364 WINWORD.EXE 2364 WINWORD.EXE 2364 WINWORD.EXE 2364 WINWORD.EXE 2364 WINWORD.EXE 2364 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\virusshare\4\VirusShare_4b8eb7fe75f72c1c5c1f80af9cd165d2.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2364