agreement-84[.]xls | Triage™

Resubmissions

03/02/2021, 16:15

210203-8r8rt3bp1e

02/02/2021, 17:05

210202-x4ffykjpzn10

01/02/2021, 15:18

210201-6pjhlsllq210

Sharing

Copy URL Twitter E-mail

Reason

office: non-rc4 encrypted document not supported

General

Target
agreement-84.xls
Size 125KB
Sample210203-8r8rt3bp1e
SHA256 0e094197fca1947eb189006ddeb7d6ad9e5d1f58229e929bc0359887ed8a667d
MD5 cf489853a42fb7520f19242a8921775d
SHA1 734e56466b525e822436b61f13a76eda051ea15a
SHA512 6f0cd4126162830b6739509abd3762507c2f300c87414775a094076e624d1f5b6e113b48aa342f238f25bc0d39208959bd134e462d2215d69224832df9a23c62
MD5 SHA1 SHA512

Score

8^/10

macro xlm

Malware Config

Signatures

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

resource	yara_rule
sample	office_xlm_macros

File Explorer

agreement-84.xls

.xls 125KB

agreement-84.xls

SHA256 0e094197fca1947eb189006ddeb7d6ad9e5d1f58229e929bc0359887ed8a667d
MD5 cf489853a42fb7520f19242a8921775d
SHA1 734e56466b525e822436b61f13a76eda051ea15a
SHA512 6f0cd4126162830b6739509abd3762507c2f300c87414775a094076e624d1f5b6e113b48aa342f238f25bc0d39208959bd134e462d2215d69224832df9a23c62
MD5 SHA1 SHA512

windows office2003

Suspicious Office macro

Office document equipped with 4.0 macros.

macro xlm