9c696cb9_by_Libranalysis | Triage

Sharing

General

Target

9c696cb9_by_Libranalysis
Size

2.4MB
MD5

9c696cb9c1c105267728511ff6b56279
SHA1

3e97c42c9a074393971f138eeda73c4d6848b3e4
SHA256

63abc500d2a9f12692276d1cd2becc0ce16719ab69a69ea9827bd411f12b4291
SHA512

0b73a172673b9b6db8e2b220661f48be803d7f805adc1511c0050c6f034f21e45603f52f63d461d2ca687380ae9c7ceb2d2c524dd662aea93d57e16fc96d3606

Score

8^/10

macro

Malware Config

Signatures

Suspicious Office macro 2 IoCs

Office document equipped with macros.

Processes:

resource	yara_rule
static1/unpack001/BOL.xlsm	office_macros
static1/unpack001/Inv_399139_86191.xlsm	office_macros

NSIS installer 6 IoCs

Processes:

resource	yara_rule
static1/unpack001/BANK RECEIPT.exe	nsis_installer_1
static1/unpack001/BANK RECEIPT.exe	nsis_installer_2
static1/unpack001/PO.exe	nsis_installer_1
static1/unpack001/PO.exe	nsis_installer_2
static1/unpack001/STATEMENT OF ACCOUNT.exe	nsis_installer_1
static1/unpack001/STATEMENT OF ACCOUNT.exe	nsis_installer_2

Files

9c696cb9_by_Libranalysis
.rar
BANK RECEIPT.exe
.exe windows x86
BOL.xlsm
.xlsm office2007

ThisWorkbook

Sheet1
Inv_399139_86191.xlsm
.xlsm office2007

ThisWorkbook

Sheet1
Ordine 400225.xlxs.img
.iso
Ordine 400225.xlxs.exe
.exe windows x86
PO.exe
.exe windows x86
STATEMENT OF ACCOUNT.exe
.exe windows x86
SWIFT-MT103_10262020.pdf.exe
.exe windows x86
inquiries for WCB .exe
.exe windows x86