43b6b0af744124da5147aba81a98bc7188718d5d205acf929affab016407d592
Classification: Malicious
43b6b0af744124da5147aba81a98bc7188718d5d205acf929affab016407d592 is a trojan (Word document, 1.2 MB). Flagged by 28% of antivirus engines (50 detections).
Detection summary
- 50 antivirus detections (28% detection ratio)
- 0 IDS alerts
- 1 processes observed
- 2 contacted hosts
- 2 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Invisimole |
Maltiverse |
2023-03-31 04:13:54 |
2023-04-01 00:17:30 |
malicious-activity
|
S0260 InvisiMole
|
| Ghostwriter |
Maltiverse |
2023-03-31 04:13:55 |
2023-04-01 00:17:24 |
malicious-activity
|
|
| CVE-2017-0199 |
Hybrid-Analysis |
2020-06-11 09:45:04 |
2020-06-11 09:45:04 |
|
|
Sample information
- Filenames
- 43b6b0af744124da5147aba81a98bc7188718d5d205acf929affab016407d592
- File type
- Microsoft Word 2007+
- Size
- 1244546 bytes
- MD5
306310e0d2c0a497d968be1120b05143- SHA-1
026b8c0429cebf6d573944712553d58b83e4d4c0- SHA-256
43b6b0af744124da5147aba81a98bc7188718d5d205acf929affab016407d592- First indexed
- 2020-06-11 09:45:04
- Last updated
- 2026-09-17 02:23:54
Antivirus detections
| Engine | Detection |
|---|
| MicroWorld-eScan | Trojan.GenericKD.33988563 |
| FireEye | Trojan.GenericKD.33988563 |
| Arcabit | Trojan.Generic.D2069FD3 |
| Cyren | Trojan.MOUN-0 |
| Kaspersky | HEUR:Trojan-Downloader.MSOffice.Agent.gen |
| BitDefender | Trojan.GenericKD.33988563 |
| NANO-Antivirus | Exploit.Xml.CVE-2017-0199.equmby |
| ViRobot | DOC.S.Exploit.1244546 |
| Ad-Aware | Trojan.GenericKD.33988563 |
| McAfee-GW-Edition | Artemis |
| MAX | malware (ai score=100) |
| AegisLab | Trojan.MSOffice.Agent.a!c |
| ZoneAlarm | HEUR:Trojan-Downloader.MSOffice.Agent.gen |
| ALYac | Trojan.Downloader.DOC.Gen |
| Zoner | Probably Heur.W97OleLink |
| GData | Trojan.GenericKD.33988563 |
| Qihoo-360 | Generic/Trojan.Downloader.643 |
| AhnLab-V3 | Downloader/XML.External |
| Alibaba | TrojanDownloader:Office/Obfuscated.45c21570 |
| Antiy-AVL | Trojan[APT]/MSOffice.Lazarus |
| Arcabit | Trojan.Groooboor.Gen.23 [many] |
| BitDefender | Trojan.Groooboor.Gen.23 |
| CAT-QuickHeal | XML.Downloader.38681 |
| CTX | docx.trojan.groooboor |
| ClamAV | Win.Malware.Agent-9377377-0 |
| DrWeb | W97M.DownLoader.4915 |
| ESET-NOD32 | a variant of Generik.BQFLRGL |
| Emsisoft | Trojan.Groooboor.Gen.23 (B) |
| Fortinet | MSOffice/RemoteTemplate.gen |
| GData | Trojan.Groooboor.Gen.23 |
| Google | Detected |
| Ikarus | W97M.Trojan-Downloader.Agent |
| K7AntiVirus | Trojan ( 0001140e1 ) |
| K7GW | Trojan ( 0001140e1 ) |
| Kingsoft | Win32.Troj.Undef.a |
| Lionic | Trojan.MSWord.Groooboor.a!c |
| McAfee | Trojan-FRVP!F3FD95261782 |
| MicroWorld-eScan | Trojan.Groooboor.Gen.23 |
| Rising | Exploit.ExtLink/OFFICE!1.DD7A (CLASSIC) |
| Skyhigh | Trojan-FRVP!F3FD95261782 |
| Sophos | Troj/DocDl-ZFL |
| Symantec | Trojan.Mdropper |
| Tencent | Trojan.Win32.Office_Dl.11020574 |
| TrendMicro | Trojan.W97M.CVE20170199.FAIL |
| TrendMicro-HouseCall | Trojan.W97M.CVE20170199.FAIL |
| VIPRE | Trojan.Groooboor.Gen.26 |
| Varist | CVE170199 |
| ZoneAlarm | Troj/DocDl-ZFL |
| alibabacloud | Trojan[downloader]:MSOffice/Donoff.MD8PHU |
| huorong | HEUR:OMacro/Downloader.de |
Process list
| Name | Command line |
|---|
| WINWORD.EXE | /n "C:\43b6b0af744124da5147aba81a98bc7188718d5d205acf929affab016407d592.doc" |