Extracted

• • Target

    document-37-1849.xls

  • Size

    187KB

  • MD5

    c41a21a821bcdea1d3ab26ebef055eed

  • SHA1

    912c8c1792dd33bac263df4b71242078d74741e9

  • SHA256

    d1d0ac76e59b9e2a8ae3a433e0186d74fc61417c89fe5ee4b93c02faa1dc58f8

  • SHA512

    ed665e9a7d3e950318628ad4ea112da063e4f156ea7d2d58fbeaa31cc2486c7d2debb779da72723d8f55bdec6b9a4b87f9d148c50b0a368c4bc5b59ac646a42a

  Score

  10^/10

  doublebackbackdoor

  • DoubleBack

    DoubleBack is a modular backdoor first seen in December 2020.

    backdoordoubleback

  • DoubleBack x64 Payload

  • DoubleBack x86 Payload

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2