OrderSheet[.]pps | Triage™

General

Target
OrderSheet.pps
Size 111KB
Sample210406-ymvpf35thx
SHA256 c45ecb10594b32cb49ec4e3356acd59b2e0819555c747657a7ce45993e5e57d7
MD5 04772bbc01d2088b18a869755d93b9d0
SHA1 7b5672c1febeca9bc97d17951b57c9f59f9de708
SHA512 bd33b07e0a195e8e9148d00e447f55ef9197fc84f5d20df8d5bf9dfc6e2e2538b5def720e49f97ec5594ec77725a17793187c1169affdfed8a41a0b468af41a5
MD5 SHA1 SHA512

Score

8^/10

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

resource	yara_rule
sample	office_macro_on_action

Suspicious Office macro 1 IoCs

Office document equipped with macros.

resource	yara_rule
sample	office_macros

Document created with cracked Office version 1 IoCs

Office document contains Grizli777 string known to be caused by using a cracked version of the software.

resource	yara_rule
sample	grizli777_cracked_office

SHA256 c45ecb10594b32cb49ec4e3356acd59b2e0819555c747657a7ce45993e5e57d7
MD5 04772bbc01d2088b18a869755d93b9d0
SHA1 7b5672c1febeca9bc97d17951b57c9f59f9de708
SHA512 bd33b07e0a195e8e9148d00e447f55ef9197fc84f5d20df8d5bf9dfc6e2e2538b5def720e49f97ec5594ec77725a17793187c1169affdfed8a41a0b468af41a5
MD5 SHA1 SHA512

Office macro that triggers on suspicious action

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action
Suspicious Office macro

Office document equipped with macros.

macro
Document created with cracked Office version

Office document contains Grizli777 string known to be caused by using a cracked version of the software.

macro