May Order 2020,XLS[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
May Order 2020,XLS.exe
Size 473KB
Sample201109-7vfd2wnb9a
SHA256 4b0c035a10e85e131f8000873e32c6d75672b0052a7bb6ae29d45ac4d3cadd4f
MD5 ef23d7d71701475b067f4d8d52cbb5b2
SHA1 c9e9b6d30fcbf0c39edff759da6e5fca435cf8f4
SHA512 7a635a9ba04d9065b25df3b823b5951e6949861dfce049b6dfc313f4f959393ab13a6183a9cd95737f3df6b6236afe861df797520678dde8e9d8eeff7fcf9e7e
MD5 SHA1 SHA512

Score

9^/10

Malware Config

Signatures

ServiceHost packer 1 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
sample	servicehost

File Explorer

May Order 2020,XLS.exe

.exe 473KB

May Order 2020,XLS.exe

SHA256 4b0c035a10e85e131f8000873e32c6d75672b0052a7bb6ae29d45ac4d3cadd4f
MD5 ef23d7d71701475b067f4d8d52cbb5b2
SHA1 c9e9b6d30fcbf0c39edff759da6e5fca435cf8f4
SHA512 7a635a9ba04d9065b25df3b823b5951e6949861dfce049b6dfc313f4f959393ab13a6183a9cd95737f3df6b6236afe861df797520678dde8e9d8eeff7fcf9e7e
MD5 SHA1 SHA512

windows x86

ServiceHost packer

Detects ServiceHost packer used for .NET malware