PO 71035[.]pps

General

Target

PO 71035.pps
Size

82KB
MD5

76b3407328a71015dbc4afc88f17cd49
SHA1

fc52c238d348c7ebe5078489ed478bbb3b03b83d
SHA256

0d49d76014a2eeb82b331092ee3ba58548c564dea13451fada229da7fda132b1
SHA512

ef793485309bdd790d6c90162716e9629c1c338c0b4173648dfce97980c61d716df16be5ea361a857b03c5fc75ae8378fcfcc358a258d40829a7076f78880955

Score

8^/10

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

Processes:

resource	yara_rule
sample	office_macro_on_action

Suspicious Office macro 2 IoCs

Office document equipped with 4.0 macros.

Processes:

resource	yara_rule
sample	office_xlm_macros
sample	office_macros

Document created with cracked Office version 1 IoCs

Office document contains Grizli777 string known to be caused by using a cracked version of the software.

Processes:

resource	yara_rule
sample	grizli777_cracked_office