General
-
Target
Cancellation_Letter_1482876532-02242021.xls
-
Size
144KB
-
Sample
210224-8z74s3kfss
-
MD5
16f442522a4ffe6a4759023fcd5478e0
-
SHA1
fd2c36091fd8428d9f3c73e5e51756c8959487c8
-
SHA256
23cd34423b173c7ec0aa25f8f2729d3e621d1cb0b7cb2810c2eb850e8a35225b
-
SHA512
ef934f47d8bb368c2628e85fa5c2edb1ca5a5b856b5385663cdf367b2d05b41c0d2b21df9660ed8f8398dcd9d1e673665db5dc37bdece77aecd6723fd3038bbc
Behavioral task
behavioral1
Sample
Cancellation_Letter_1482876532-02242021.xls
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Cancellation_Letter_1482876532-02242021.xls
Resource
win10v20201028
Malware Config
Extracted
http://slmtv.com/tfbgl/44251784720833300000.dat
http://dicomm-001-site35.ctempurl.com/pmslsda/44251784720833300000.dat
http://konyahaberler.xyz/hxjxxwav/44251784720833300000.dat
http://pandsquinny.com/nlbzyhfs/44251784720833300000.dat
http://www.kunjincompany.com/anesrq/44251784720833300000.dat
Targets
-
-
Target
Cancellation_Letter_1482876532-02242021.xls
-
Size
144KB
-
MD5
16f442522a4ffe6a4759023fcd5478e0
-
SHA1
fd2c36091fd8428d9f3c73e5e51756c8959487c8
-
SHA256
23cd34423b173c7ec0aa25f8f2729d3e621d1cb0b7cb2810c2eb850e8a35225b
-
SHA512
ef934f47d8bb368c2628e85fa5c2edb1ca5a5b856b5385663cdf367b2d05b41c0d2b21df9660ed8f8398dcd9d1e673665db5dc37bdece77aecd6723fd3038bbc
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-