Extracted

• • Target

    cancel_sub_JPLyeahyourenotgettingmynumber.xlsb

  • Size

    264KB

  • MD5

    f1b51acf675dd0973ce3ec78fd9a1859

  • SHA1

    83e8858f1d6a849151289a7c507a740d59e5da79

  • SHA256

    7c2dae7cfc7b469c26b14d5cf7aed0e063ab8f854c7563d1e7fca448e6827a05

  • SHA512

    9ce754214b348348fbdbdc933a61c9f01646f8021769c1c683fe1eb7d5af59e22950226233244cd7f304944164b46a55d708a668e01cf115085466357b766b43

  Score

  10^/10

  nloaderloader

  • Nloader

    Simple loader that includes the keyword 'campo' in the URL used to download other families.

    loadernloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Nloader Payload

  • Blocklisted process makes network request

  • Loads dropped DLL

  behavioral1behavioral2