Static task
static1
Behavioral task
behavioral1
Sample
test/0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc
Resource
win10-en-20210920
Behavioral task
behavioral2
Sample
test/0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc
Resource
win10-en-20210920
Behavioral task
behavioral3
Sample
test/91B5DB3C0CCBD68BD04C24571E27F99D.msi
Resource
win10-en-20210920
Behavioral task
behavioral4
Sample
test/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10-en-20210920
Behavioral task
behavioral5
Sample
test/fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win10-en-20210920
General
-
Target
gevaarlijk.zip
-
Size
7.3MB
-
MD5
d67d29dfc872a069a1f6fe7eec57becb
-
SHA1
e47cf8238cfb8aa1012e5de1e44d46b23d867f97
-
SHA256
72b228f51cf5a1b7600f0e0848145e4e54e54838977a5a5b1c85f69b64b92cf5
-
SHA512
8302ebb02d97800dc6495101129930606a65096556b1d004b94d757a31d0c8935edca87d072d8c0059c055203bead0a2d59a0cf7150f6f954b0be0bfc9849dc7
Malware Config
Signatures
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
Processes:
resource yara_rule static1/unpack001/test/0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc office_macro_on_action -
Processes:
resource yara_rule static1/unpack001/test/0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc office_macros static1/unpack001/test/0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc office_macros static1/unpack001/test/91B5DB3C0CCBD68BD04C24571E27F99D.msi office_xlm_macros -
NSIS installer 2 IoCs
Processes:
resource yara_rule static1/unpack001/test/fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe nsis_installer_1 static1/unpack001/test/fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe nsis_installer_2
Files
-
gevaarlijk.zip.zip
-
__MACOSX/._test
-
__MACOSX/test/._.DS_Store
-
__MACOSX/test/._0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc
-
__MACOSX/test/._0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc
-
__MACOSX/test/._91B5DB3C0CCBD68BD04C24571E27F99D.msi
-
__MACOSX/test/._ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
-
__MACOSX/test/._fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
-
test/.DS_Store
-
test/0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc.doc windows office2003
ThisDocument
ulwMK8UL
hCxOn1
ZP5AW
f
-
test/0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc.doc windows office2003
pXirGKdhzK
jwCWVLSqL
-
test/91B5DB3C0CCBD68BD04C24571E27F99D.msi.msi .vbs
-
test/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe.exe windows x86
-
test/fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe.exe windows x86