Overview

overview

10

Static

static

8

document-1...43.xls

windows7_x64

10

document-1...43.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    document-1627621543.xls

  • Size

    138KB

  • Sample

    210313-93b48chvba

  • MD5

    f3f068df7f15a9b1700c5b59e6f8db2f

  • SHA1

    e398e7513f72cafc29bad79f7f3fabbdb9190aca

  • SHA256

    30d32f41bb3853a46a0625883e180b38599fe4b67eb5a65dc8a92d0626797f4e

  • SHA512

    8e22f70f0c25193d7aa0db542ca63d453139211383d52f30e7bfab81a38180954163a30ad3aa5c0bbf6e14b23384a8ff2d3d2b0e48e13d29496c5a372442d233

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://nvelj12qyyfi03kqxy.xyz/i.gif

Targets

    • Target

      document-1627621543.xls

    • Size

      138KB

    • MD5

      f3f068df7f15a9b1700c5b59e6f8db2f

    • SHA1

      e398e7513f72cafc29bad79f7f3fabbdb9190aca

    • SHA256

      30d32f41bb3853a46a0625883e180b38599fe4b67eb5a65dc8a92d0626797f4e

    • SHA512

      8e22f70f0c25193d7aa0db542ca63d453139211383d52f30e7bfab81a38180954163a30ad3aa5c0bbf6e14b23384a8ff2d3d2b0e48e13d29496c5a372442d233

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks