Extracted

• • Target

    subscription_1617291613.xlsb

  • Size

    228KB

  • MD5

    8a3364bafa63166394862068b05f5469

  • SHA1

    b039cb7a479cf118d53c61e113ad74015caadd22

  • SHA256

    3d0b681046147d8008b70bab97c41e3a21a283559874ac2ce0c518b6965312da

  • SHA512

    27c70c7fd278222a17112c0e3deb16a84f36f080a6fd933d51c4cc73392654414991ae0ba99e9760008c40a865572380c03a3b3af9297cb1a3678c630ca18111

  Score

  10^/10

  nloaderloader

  • Nloader

    Simple loader that includes the keyword 'campo' in the URL used to download other families.

    loadernloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Nloader Payload

  • Loads dropped DLL

  behavioral1behavioral2