Extracted

• • Target

    cancel_sub_JPL12345678901234.xlsb

  • Size

    260KB

  • MD5

    80fdec003c86c583473a9fbbabf40d2f

  • SHA1

    991940040a50a0be56572e4a9ab73d6d4dbab050

  • SHA256

    49e315aa89bf10972518c3069a767c869bbf7027c298afd11ab21040285b3f9e

  • SHA512

    022475db6593d15bdcc1411f7c3b88a8822311f621506401ad3ba33ddc2a52ae6e97e4357e3742bf59ef287c033f5363cb5d2021be793d5552a3a8b73b85cfa5

  Score

  10^/10

  nloaderloader

  • Nloader

    Simple loader that includes the keyword 'campo' in the URL used to download other families.

    loadernloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Nloader Payload

  • Blocklisted process makes network request

  • Loads dropped DLL

  behavioral1behavioral2