General
- Target Offer[2022.01.25_13-45].xll
- Size 5.5MB
- Sample220125-tbg63aacdm
- SHA256 237814700a67d51bee28e128a6c00608320575015ac3c84bb51093463eca6f01
- MD5 d45d9212bfadd7dd82f197fab5524417
- SHA1 784dd6d2540be71c892b5f4af9d77f6b5c1e999e
- SHA512 8c710874c79e75f7704b474123571fbb4248a78b9bde47fab136c704218e07fefac966ee3b499ced399a748d0a9c7cfde5ee01f60d67e8f835dcba1eb64d1932
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Offer[2022.01.25_13-45].xll
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Offer[2022.01.25_13-45].xll
Resource
win10-en-20211208
0 signatures
0 seconds
Malware Config
Targets
-
- Target Offer[2022.01.25_13-45].xll
- Size 5.5MB
- SHA256 237814700a67d51bee28e128a6c00608320575015ac3c84bb51093463eca6f01
- MD5 d45d9212bfadd7dd82f197fab5524417
- SHA1 784dd6d2540be71c892b5f4af9d77f6b5c1e999e
- SHA512 8c710874c79e75f7704b474123571fbb4248a78b9bde47fab136c704218e07fefac966ee3b499ced399a748d0a9c7cfde5ee01f60d67e8f835dcba1eb64d1932
- MD5 SHA1 SHA512
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Bazar/Team9 Loader payload
-
Blocklisted process makes network request
-
Loads dropped DLL