Malware Hash Query

This utility queries our own database,,, and Team-CYMRU for known malware hashes and links to analysis reports.


File: dokilat.doc
File size: 342436 bytes
File type: data
MD5: e208251c3837c32f1886629ba5484189
SHA1: 7d0e4df4b6cf540b56cd6565bc108a59af908cb0
SHA256: 06e0916013ca022d29dbd6becd32cb91e6ffbfb552775dd9e72923565db6a6f6
SSDEEP: 6144:kQT1EQDg9gS9+KG5cL1qNGEAWDYZZEhPP+0F2aX2d2+Y:k6yQaPvwchqNGn1TEhW0Fgd2l
Reported: 2016-09-19 22:17:20
Detection engine: 213
Result: Suspicious file - Embedded Executable
Confidence: 50
Scan hits: 1

Embedded Executable:

XOR encryption: Yes
Bitwise ROL cipher: No
Replacement cipher: No
Mathematical substitution cipher: No

Search type: xordb
Matching: full
Key Length: 256 bytes
Key Unique Sum: 32640 More
Key Location: @14561 bytes
Key Accuracy: 100.00%
Fuzzy Errors: 0
File XOR Offset: @225 bytes
XOR Key normalized hash: 9b7e14df2ffe3c32566f3fff8481c6f2 More
XOR Key:

Detected entities:

Embedded Executable: This program cannot be run in DOS mode [14639] show hexdump

RepositoryStatusMore Info

Embedded Executable
Confidence: 50
Scan hits: 1

New/Nothing Found


New/Nothing Found


New/Nothing Found


Shellcode Scan:

Shellcode not found.

Exploit Scan:

Exploit: not found.

Sandbox report:

Processing...this can take from 20 minutes to several hours depending on the load.

Comments (0): show/hide