General
-
Target
Cancellation_Letter_907142302-02242021.zip
-
Size
28KB
-
Sample
210225-rqyb727nta
-
MD5
b3524360d53383f8f8abee2dc13b8ead
-
SHA1
e0a0c628df2e8d35ee1d7fab402c88f1d809a8c5
-
SHA256
1ab2ff7a6ddcd4a3c8bec255b23abe1e817a12b5c716d3115848fa06e2630c21
-
SHA512
4f1411d2bf253783586728c0e37f7228a25da5e32261d737c7c2d698f5c832d7797109814da1414fb35b304d20837360549ef58e808b01b0218f4c07d0b4688c
Behavioral task
behavioral1
Sample
Cancellation_Letter_907142302-02242021.xls
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Cancellation_Letter_907142302-02242021.xls
Resource
win10v20201028
Malware Config
Extracted
http://slmtv.com/tfbgl/44252144191666700000.dat
http://dicomm-001-site35.ctempurl.com/pmslsda/44252144191666700000.dat
http://konyahaberler.xyz/hxjxxwav/44252144191666700000.dat
http://pandsquinny.com/nlbzyhfs/44252144191666700000.dat
http://www.kunjincompany.com/anesrq/44252144191666700000.dat
Targets
-
-
Target
Cancellation_Letter_907142302-02242021.xls
-
Size
144KB
-
MD5
8aec18ebf6993b6fef422faf10b7d2a3
-
SHA1
170818aedbf5aa2cd7e09d3f7191ec77dd3b9532
-
SHA256
20ae15df23e6fbb766575da4b6dd854020725eab7ccff4194cc36dd0adb23763
-
SHA512
f1bf8ce8405ca7b211373768f1f4e77debdf5e3a976c95dd3378d530b428c069056d477407f466e930cd8a4e7773e10d83738b213de40125fad0953c3b615db0
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-