Extracted

• • Target
    Quotation.xlsm
  • Size 62KB
  • SHA256 574b59dc1edfd81da481081c8a8eeae2f3f9c62965a25ef4ab67aacbd4ce63fa
  • MD5 f743ef79b812d3133a9374bd472e0362
  • SHA1 c3755a19e92751ae231c70936a0cb930735bab34
  • SHA512 6edd019d151e04055dbca70da43f218a5bb9903966df6ae14d83639fcfa6396013b4ba5d9bdd039df393a23b9aff9f436294a758ef8902e5092ce6dcf7d80d7e
  • MD5 SHA1 SHA512

  Score

  10^/10

  spyware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • JavaScript code in executable

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2