ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash f36542b449e0b164bf0927d48bd934aa0e66bd2fab483f532cf2010f3fc9d02b.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1780703
IOC: f36542b449e0b164bf0927d48bd934aa0e66bd2fab483f532cf2010f3fc9d02b
IOC Type :sha256_hash
Threat Type :payload
Malware: Unidentified 001
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
First seen:2026-04-04 07:10:51 UTC
Last seen:never
UUID:3686045e-2f73-11f1-9af6-42010aa4000a
Reporter Lenny_3BO
Reward 5 credits from ThreatFox
Tags:cve-2011-3230 CVE-2026-21509 exploit rtf

Avatar
Lenny_3BO
RTF exploit doc. CVE-2026-21509 + CVE-2011-3230. OLE link -> SMB 171.22.182.231/secure9/ WebDAV. Novel lsdsemihidden1 nibble encoding. Chain: test.doc -> Q.lnk -> M.k CPL -> msedgewebview.exe MITM RAT.