Leak[.]zip | Triage

Sharing

Target

Leak.zip
Size

3.0MB
MD5

cd6305e8c52cd93979c3a93164861c86
SHA1

955850b81692f2b5b83a5a7ecc2fc6f4b11618d4
SHA256

6243afcc3184f4bf3f969dd7fed686e57e574d17417ec71351bc71d5adba673d
SHA512

cb5790048002ae59ef51c9e9d99cb7eea63992a39c157f5cb748faafb28aa52388b50e863e18fa70b879c05afe899743523c3c1fa0cb8e189890551a03a0d1d4

Score

8^/10

Office macro that triggers on suspicious action 2 IoCs

Office document macro which triggers in special circumstances - often malicious.

Processes:

resource	yara_rule
sample	office_macro_on_action
static1/unpack001/Leak/Proforma invoice35117img.xls	office_macro_on_action

Suspicious Office macro 2 IoCs

Office document equipped with 4.0 macros.

Processes:

resource	yara_rule
static1/unpack001/Leak/Proforma invoice35117img.xls	office_xlm_macros
static1/unpack001/Leak/Proforma invoice35117img.xls	office_macros