General
-
Target
ddfa667a6805bf8b9216feb8df15b1590c340914d7142aa142ecb858d117ba9b
-
Size
92KB
-
Sample
220201-d2ln6sgeh9
-
MD5
4ed6536cc686553f21e7583d5257e590
-
SHA1
437dcc1cc98f92a4bdfaab6746a87403ded4dba0
-
SHA256
ddfa667a6805bf8b9216feb8df15b1590c340914d7142aa142ecb858d117ba9b
-
SHA512
b25b2702513ae30d14c849be9282940d0ae7392097d1f377dded49bf8c4f304656bcc58391ac427b1ee59ebf833394a298988f76324b23ac11b28005048f120a
Static task
static1
Behavioral task
behavioral1
Sample
ddfa667a6805bf8b9216feb8df15b1590c340914d7142aa142ecb858d117ba9b.doc
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
ddfa667a6805bf8b9216feb8df15b1590c340914d7142aa142ecb858d117ba9b.doc
Resource
win10v2004-en-20220113
Malware Config
Extracted
http://nebula-ent.com/t3
http://ektor.com.br/XWWpLxCI
http://negreiros.com.br/bin/zoZb
http://n-morimoto.jp/j583VppF
http://mscyapi.com/mscinsaat.com/cWBJXY3
Targets
-
-
Target
ddfa667a6805bf8b9216feb8df15b1590c340914d7142aa142ecb858d117ba9b
-
Size
92KB
-
MD5
4ed6536cc686553f21e7583d5257e590
-
SHA1
437dcc1cc98f92a4bdfaab6746a87403ded4dba0
-
SHA256
ddfa667a6805bf8b9216feb8df15b1590c340914d7142aa142ecb858d117ba9b
-
SHA512
b25b2702513ae30d14c849be9282940d0ae7392097d1f377dded49bf8c4f304656bcc58391ac427b1ee59ebf833394a298988f76324b23ac11b28005048f120a
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Sets service image path in registry
-