sample[.]ppt | Triage

General

Target

sample.ppt
Size

224KB
MD5

f93b770274956fb4b09e4962a45c32da
SHA1

8e295f26e68ea595aaee521db9d29d39425ffbb1
SHA256

56dd6d0c5eacf5a7ec7233c4acb4cf97df95f66ed5d4d4880dca62f6b4b27a69
SHA512

98856b284df590ec1bf8e4edeab529315a3115a9f7d1a277328fa6ad4fcf25fa120b814a5714148df05386ff4d738523b3bec1617745631a766efab5cf95ced0

Score

8^/10

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

Processes:

resource	yara_rule
sample	office_macro_on_action

Suspicious Office macro 1 IoCs
Office document equipped with macros.
macro

Processes:

resource yara_rule

sample office_macros

resource	yara_rule
sample	office_macros

Document created with cracked Office version 1 IoCs

Office document contains Grizli777 string known to be caused by using a cracked version of the software.

Processes:

resource	yara_rule
sample	grizli777_cracked_office