General

  • Target

    31520.doc

  • Size

    87KB

  • Sample

    220413-r8k8waced3

  • MD5

    2e1df76d290a94565ab02741e34fd53e

  • SHA1

    81639fcd12723d8d29cac7af5e42c1576c7915dc

  • SHA256

    c5f9b97bb1a209f6a2cebf0e7cfd205befe6b69192d4c6549efb8ec4f946a64e

  • SHA512

    193349e44552e876773f12db9e442e87fc018e2786704bcd257b01513fee9b9981bc2d393384d026cfb23da88faa72b7660b0524d3522629c2e55bf604594ecd

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://newyeargoka.top/read.php?f=0.dat

Targets

    • Target

      31520.doc

    • Size

      87KB

    • MD5

      2e1df76d290a94565ab02741e34fd53e

    • SHA1

      81639fcd12723d8d29cac7af5e42c1576c7915dc

    • SHA256

      c5f9b97bb1a209f6a2cebf0e7cfd205befe6b69192d4c6549efb8ec4f946a64e

    • SHA512

      193349e44552e876773f12db9e442e87fc018e2786704bcd257b01513fee9b9981bc2d393384d026cfb23da88faa72b7660b0524d3522629c2e55bf604594ecd

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Valyria

      Malicious Word document which is a loader for other malware.

MITRE ATT&CK Enterprise v6

Tasks