Extracted

• • Target

    subscription_1618334083.xlsb

  • Size

    182KB

  • MD5

    9d8889711256df5fba21cac45ff2be6e

  • SHA1

    72c600faaaf2168a46922b101589dff2c3579264

  • SHA256

    68ef8ffa46a0d0ea1a981ad7bcfbaf1c7ad2680ddfac2a2d4b0822a23aaf4247

  • SHA512

    7e1874bbae50d15de0b0dece24f0122ec473f1d3ea0f21ba47b25dd941fe2512800fef54047752f8f5808db586c75ef73e770d6b4b4c67aded4613979074cca7

  Score

  10^/10

  nloaderloader

  • Nloader

    Simple loader that includes the keyword 'campo' in the URL used to download other families.

    loadernloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Nloader Payload

  • Blocklisted process makes network request

  • Loads dropped DLL

  behavioral1behavioral2