Overview

overview

10

Static

static

8

Kiki

windows7_x64

10

Resubmissions

17/12/2020, 17:26

201217-wjvrnjhlg610

24/06/2020, 14:54

200624-6mjajb17m28

Sharing

Copy URL Twitter E-mail

General

  • Target
    Order-13822.xls
  • Size 111KB
  • Sample201217-wjvrnjhlg6
  • SHA256 147679b401d295a5300cde9e2ad39a1a2b5a09757c1a248dd53914bdb9678140
  • MD5 SHA1 SHA512
Score
10/10
macro

Malware Config

Extracted

Language

  • xlm4.0

Source
URLs
  • xlm40.dropper

    https://reinin.tw/wp-keys.php
  • xlm40.dropper

    https://legendcoder.com/wp-keys.php
  • xlm40.dropper

    https://pullingmezcnarcmer.tk/wp-keys.php
  • xlm40.dropper

    https://ruibrunconcallconsta.tk/wp-keys.php

Targets

    • Target
      Order-13822.xls
    • Size 111KB
    • SHA256 147679b401d295a5300cde9e2ad39a1a2b5a09757c1a248dd53914bdb9678140
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks