Report - 1d5908fef265…008a801422

Malicious CriticalFILE

Quota 46

First seen: 2021-11-13T16:15:28Z
Last seen: 2025-06-24T23:07:20Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYNot identifiedexploit

RELATED INDICATORS20Connections in this report

ANALYSISMaliciousHistorical

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 1d5908fef2656b88773e280c303c3d4e1fa05c1589afc50612a2bf008a801422
SHA1: 42a7207ce5d98ac9ab1270d3b9fd953bb12f3c3b
MD5: bcdb4ce4ce68229cdea4d8ab40565b1d
Filename: Request 11_11_2021.xlsx
File type: xlsx
MIME: application/octet-stream
File size: 620295
TLSH: T167D423EC511386E7E386406B173E921ED81EB043F93D952F36B4FA1CA2D274A8D51B1A
SSDEEP: 12288:mYnQ3e+7FktmEZSGnYx5CBTBE3HGgNyURfB59syWv/AzaglsMdLycm:W3n7BEZSGni5CzUys50yWv4zaglPccm

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 50%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections50%

VirusSign confidence100%

Relationship context20 visible

Threat classificationexploit

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

20 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

7bb51b81b7ede425722e838a14752d1c008b52d813824a14ba41e98a09c062f4

5% critical xml 892 bytes contains

Filename sheet1.xml Family cve201711882 Type trojan File type xml MIME application/xml

5dfe214e9de4f8becdcf304180177cec22af058ba55b51d75d2d49807e03365c

55% critical doc 899584 bytes contains

Filename oleObject1.bin Type exploit File type doc MIME application/octet-stream Size 899584

c067ebfb3e8317d74b95fa387a5054646a974ca620cec9d3a899cdc22d3c8116

0% xml 601 bytes contains

File type xml MIME application/xml Size 601 SHA1 64be2e97d10c13ce98617891d39bd7b550caad89 First seen 2021-11-25T18:01:53Z

165015d9e5e431e65e75ee32c9b898c4b059ca3ef63e699f326fce64f772f235

0% xml 1154 bytes contains

File type xml MIME application/xml Size 1154 SHA1 df7210b86a47c99341a8b3117ca0a8f4da4ff14a First seen 2021-12-02T06:09:19Z

fde032888013ea6cc6d652dbecc1f357f8204a5327c78e84d01057024f956b76

0% jpeg 11345 bytes contains

Filename 3E2BF2D3.jpg File type jpeg MIME application/octet-stream Size 11345 SHA1 1e2dd6780419b138ad9fc2c45b84a51abc2d6347

Related IPs

Network IPs associated with this indicator.

5shown

23.224.235.100

0% US communicates

CIDR 23.224.0.0/16 Network 23.224.0.0-23.225.255.255 First seen 2026-08-18T16:48:08Z Last seen 2026-08-18T16:48:08Z

104.233.177.157

0% SG communicates

CIDR 104.233.176.0/23 First seen 2023-11-14T06:19:16Z Last seen 2023-11-14T06:19:16Z

172.96.191.39

5% low SG communicates

CIDR 172.96.190.0/23 Network 172.96.184.0-172.96.191.255 First seen 2026-05-11T23:27:12Z Last seen 2026-05-23T03:05:24Z

172.67.150.120

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-10-03T01:00:00Z Last seen 2026-11-12T00:01:38Z

104.21.30.35

0% US communicates

CIDR 104.20.0.0/15 Network 104.16.0.0-104.31.255.255 First seen 2023-09-30T16:34:38Z Last seen 2026-11-12T00:01:37Z

Related domains

Domains associated with this indicator.

5shown

www.mediahouselemarss.com

0% .com communicates

Root mediahouselemarss.com TLD com Subdomain www First seen 2022-09-11T08:12:05Z Last seen 2022-09-11T08:12:05Z

www.lightswartoyof5.xyz

.xyz communicates

Root lightswartoyof5.xyz TLD xyz Subdomain www First seen 2021-11-19T16:42:07Z Last seen 2025-04-09T04:16:11Z

www.austrianlankavilla.com

0% .com communicates

Root austrianlankavilla.com TLD com Subdomain www First seen 2018-05-23T16:16:55Z Last seen 2025-06-11T12:24:12Z

roadsidefarmers.com

.com communicates

Root roadsidefarmers.com TLD com First seen 2025-05-07T20:16:12Z Last seen 2026-05-11T04:40:40Z

mediahouselemarss.com

0% .com communicates

Root mediahouselemarss.com TLD com First seen 2022-09-10T07:47:50Z Last seen 2025-12-25T05:22:08Z

Related URLs

URLs associated with this indicator.

5shown

http://www.blessedunrest.com/upwd/

7% high communicates

TLD com HTTP status 404 Content length 13792 Content SHA256 2b8001fcc491a43ac6b03ea26fd5aad52fbb985de22723328f6ad3225dfb205f First seen 2021-11-12T08:41:28Z

http://www.corajevedrai.quest/upwd/?…

4% low communicates

TLD quest HTTP status 403 Content length 580 Content SHA256 e2af7c63ec10394c76345311f7d8e667e3ebbcef081653e9ad58bb7412069579 First seen 2021-11-13T23:54:08Z

http://www.shankareducation.com/upwd/

0% communicates

TLD com HTTP status 404 Content length 2457 Content SHA256 3d70ce95eb1eb78620cc57fe1a6a479e6f2d70508bf813238e573863df000d6e First seen 2021-11-12T08:41:28Z

http://www.mediahouselemarss.com/upwd/?…

4% low communicates

TLD com HTTP status 404 Content length 182818 Content SHA256 72a27c5d7fb6bdb061135a54a7d42c64284b84c72d5a1cb2aee0f0d3b33b798c First seen 2021-11-13T23:54:08Z

http://www.football-news-now.pro/upwd/

4% low communicates

TLD pro HTTP status 301 First seen 2021-11-11T14:07:30Z Last seen 2025-12-26T13:48:24Z

Analysis details

Severity: criticalexploitxlsxcve-2017-11882wmi-activitycve-2018-0802cve-2017-1182cve-2018-0798ratloaderdebug-check

Freshness: Historical · Last seen 505 days ago.

Detection rate: 50%
Threat type: exploit
Confidence: 100%
detection: 50 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 1d5908fef2656b88773e280c303c3d4e1fa05c1589afc50612a2bf008a801422
SHA1: 42a7207ce5d98ac9ab1270d3b9fd953bb12f3c3b
MD5: bcdb4ce4ce68229cdea4d8ab40565b1d
Filename: Request 11_11_2021.xlsx
File type: xlsx
MIME: application/octet-stream
File size: 620295
TLSH: T167D423EC511386E7E386406B173E921ED81EB043F93D952F36B4FA1CA2D274A8D51B1A
SSDEEP: 12288:mYnQ3e+7FktmEZSGnYx5CBTBE3HGgNyURfB59syWv/AzaglsMdLycm:W3n7BEZSGni5CzUys50yWv4zaglPccm
First seen: 2021-11-13T16:15:28Z
Last seen: 2025-06-24T23:07:20Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 50%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type exploit.

Relationship context

20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

21 timestamped observations are arranged from 2018-05-23 to 2026-08-18. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 50%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 20 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification exploit

Classification context: type exploit.

Intelligence freshness Historical

Last seen 505 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: Request 11_11_2021.xlsx
File type: xlsx
MIME: application/octet-stream
Size: 620295

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

wmi-activitydebug-check

View MITRE ATT&CK details · 5 shown

T1036 — Creates files inside the user directory
Tactics: TA0005
T1203 — Office equation editor starts processes (likely CVE 2017-11882)
Tactics: TA0002
T1071 · T1095 — Performs DNS lookups
Tactics: TA0011
T1083 — Reads ini files
Tactics: TA0007
T1018 — Reads the hosts file
Tactics: TA0007

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 80, 53

5+ outbound connections observed
5+ domains, 5+ IPs, 5+ URLs
Common ports: 80, 53
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: hanafoodco.com
URL: http://hanafoodco.com/wp-content/plugins/masterx/request_iso_003820_1008516pdf.exe
Protocol: HTTP

IP: 64.190.62.111
Port: 80
Protocol: TCP

Domain: www.lightswartoyof5.xyz
URL: http://www.lightswartoyof5.xyz/upwd/
Protocol: HTTP

Domain: www.insularrofioa.xyz
URL: http://www.insularrofioa.xyz/upwd/?1behn6g=+wymnqauqnghdqvovlzoljtt2gzbnftdqbq2domqecv4hltc8ldxphsfx+wmczzjbl1ukw==&r0=cfmlfnyparwxd
Protocol: HTTP

Domain: www.insularrofioa.xyz
URL: http://www.insularrofioa.xyz/upwd/
Protocol: HTTP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: hanafoodco.com

Query: hanafoodco.com
Type: A
Answers: 88.135.36.254
Response: NOERROR

Query: www.insularrofioa.xyz
Type: A
Answers: 198.54.117.211, 198.54.117.215, 198.54.117.212, 198.54.117.218, 198.54.117.210, 198.54.117.217, 198.54.117.216
Response: NOERROR

Query: www.vibeax.com
Type: A
Answers: 23.227.38.74
Response: NOERROR

Query: www.shankareducation.com
Type: A
Answers: 2.57.91.208
Response: NOERROR

5 shown

C2 candidates1

DNSports 53

1 C2 candidate communications
1 domains, 1 IPs
Common ports: 53
Protocols: DNS

View details · 1 shown

IP: 88.135.36.254
Domain: hanafoodco.com
Port: 53
Protocol: DNS

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check