Extracted

• • Target

    subscription_1615866472.xlsb

  • Size

    279KB

  • MD5

    07571645cfa9005361c68f1d84975550

  • SHA1

    b9020bd1ae5f35489a288f2e5aa7c068e08d540d

  • SHA256

    ee9ba17fb42f85ed79f5a9f15673327579538de8eb268ea134b97bff3f54c44c

  • SHA512

    3345b205c17240f5d11265491de01530e99ae37b4d7f3ae482bd09f23e184bba5c109b027dc56fa3b8ff331eca999b69571cf2fba1adb39ddcee64fd55f30fe7

  Score

  10^/10

  nloaderloader

  • Nloader

    Simple loader that includes the keyword 'campo' in the URL used to download other families.

    loadernloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Nloader Payload

  • Blocklisted process makes network request

  • Loads dropped DLL

  behavioral1behavioral2