Billing Invoice - Job # 4712264[.]doc | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Billing Invoice - Job # 4712264.doc
Size 86KB
Sample210128-vtm648fcfn
SHA256 1f33a3b176c7062a63b392a64c21e5c05bcd0c920a363bbcde4a1a0bc9ad2b8d
MD5 2d2b0c7b4325da2fa989ea8ac308697b
SHA1 5f182251f6c4bb194b780737445816745343fdd1
SHA512 4a9a94851f88b0502888fbc125e6c4a82cb36a6c2e0495855580b483133bf7657e3159b23883b2fe8024c2af3548fb1f1490788d0a3f65ed3f4645bcc9f372de
MD5 SHA1 SHA512

Score

8^/10

macro xlm macro_on_action

Malware Config

Signatures

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
sample	office_macro_on_action

Suspicious Office macro 2 IoCs

Office document equipped with 4.0 macros.

resource	yara_rule
sample	office_xlm_macros
sample	office_macros

File Explorer

Billing Invoice - Job # 4712264.doc

.doc 86KB

Billing Invoice - Job # 4712264.doc

SHA256 1f33a3b176c7062a63b392a64c21e5c05bcd0c920a363bbcde4a1a0bc9ad2b8d
MD5 2d2b0c7b4325da2fa989ea8ac308697b
SHA1 5f182251f6c4bb194b780737445816745343fdd1
SHA512 4a9a94851f88b0502888fbc125e6c4a82cb36a6c2e0495855580b483133bf7657e3159b23883b2fe8024c2af3548fb1f1490788d0a3f65ed3f4645bcc9f372de
MD5 SHA1 SHA512

windows office2003

Office macro that triggers on suspicious action

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action
Suspicious Office macro

Office document equipped with 4.0 macros.

macro xlm

hBfqbVnmID

RlVbNBNdqzcwzt

RACSTHm