c1110237231589eb7cb435f52783b0eb917baca45b075e8f78d5b78a0fe66688

General

Target

c1110237231589eb7cb435f52783b0eb917baca45b075e8f78d5b78a0fe66688
Size

707KB
MD5

1622576dd5cc993ae42f5c35b4b9ed2f
SHA1

6071d99ea546e6d74656bf8114bcd7a663eb84ba
SHA256

c1110237231589eb7cb435f52783b0eb917baca45b075e8f78d5b78a0fe66688
SHA512

6d9501e71c7095050b1bd8a2ca467f926b008c6f36c17ce673b012730e3fc33dc29fd513e875635e6fc6cc446e57a0572477f82df038d4d81870a78447a29804

Score

8^/10

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

Processes:

resource	yara_rule
sample	office_macro_on_action

Document created with cracked Office version 1 IoCs

Office document contains Grizli777 string known to be caused by using a cracked version of the software.

Processes:

resource	yara_rule
sample	grizli777_cracked_office

c1110237231589eb7cb435f52783b0eb917baca45b075e8f78d5b78a0fe66688
.pps windows office2003

Procilit