General
-
Target
Cancellation_Letter_284726374-02242021.xls
-
Size
144KB
-
Sample
210224-72rgbh39qj
-
MD5
421de792f2c24cb994f9e9d17729a51a
-
SHA1
92001d386aefaecda416eebb1396867a5a86a425
-
SHA256
d30dca05a381ea0ca9740238fc7b50e5174785a17dd0efe1418d0038a99bc486
-
SHA512
4c7e02649888a8c92668098cfbe0dfbe322d5da23bd943f9dc0a4df9ba092cb73b5c81487b4ed17da8401fd96bace0fb26875932e0951f156721ca9e8194bc4b
Behavioral task
behavioral1
Sample
Cancellation_Letter_284726374-02242021.xls
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Cancellation_Letter_284726374-02242021.xls
Resource
win10v20201028
Malware Config
Extracted
http://slmtv.com/tfbgl/44251725534490700000.dat
http://dicomm-001-site35.ctempurl.com/pmslsda/44251725534490700000.dat
http://konyahaberler.xyz/hxjxxwav/44251725534490700000.dat
http://pandsquinny.com/nlbzyhfs/44251725534490700000.dat
Targets
-
-
Target
Cancellation_Letter_284726374-02242021.xls
-
Size
144KB
-
MD5
421de792f2c24cb994f9e9d17729a51a
-
SHA1
92001d386aefaecda416eebb1396867a5a86a425
-
SHA256
d30dca05a381ea0ca9740238fc7b50e5174785a17dd0efe1418d0038a99bc486
-
SHA512
4c7e02649888a8c92668098cfbe0dfbe322d5da23bd943f9dc0a4df9ba092cb73b5c81487b4ed17da8401fd96bace0fb26875932e0951f156721ca9e8194bc4b
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-