Extracted

• • Target

    Private document.docm

  • Size

    2.0MB

  • MD5

    526e3392d7634da433db9ae9dce6a9b6

  • SHA1

    f182af125f4b8b0953ab2755e50dc5a8ba3294c9

  • SHA256

    63e6f759e7978643e5b7998f737688b8a5c08ad0ce843ba20822c7d9125e4714

  • SHA512

    961d2b015376d723023f55659b9c1d3f7bdccf934d73c751cb7acf1fa8685a5e88308c8feb31bc132487d243c060b2fdcd2c176a1d1dd23d0c22339f342aeab1

  Score

  10^/10

  buerloader

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Buer Loader

    Detects Buer loader in memory or disk.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2