9161bc0ac7fd107278182e5220134b057915525c78ef256713b9ef6a4ccab4b6

General

Target

9161bc0ac7fd107278182e5220134b057915525c78ef256713b9ef6a4ccab4b6
Size

83KB
MD5

43d6c3f16b3af2b31f6db8cf8702b5c8
SHA1

51a1010f9b54cb916474d288694a8255809f7843
SHA256

9161bc0ac7fd107278182e5220134b057915525c78ef256713b9ef6a4ccab4b6
SHA512

20a5cbb63445b08e08f9cc03152a2577f4e8a7f19d899c0aaac4450199305529c1d9cacacb8193b863d4d7c278dee2e32a1ee9083dccb39fb0bee42476e4238f

Score

8^/10

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

Processes:

resource	yara_rule
sample	office_macro_on_action

Suspicious Office macro 2 IoCs

Office document equipped with 4.0 macros.

Processes:

resource	yara_rule
sample	office_xlm_macros
sample	office_macros

Document created with cracked Office version 1 IoCs

Office document contains Grizli777 string known to be caused by using a cracked version of the software.

Processes:

resource	yara_rule
sample	grizli777_cracked_office