63220bbe271bde6d41a30059e7c441664f3f7e3197897c38438076398e654856 | Triage

Sharing

General

Target

63220bbe271bde6d41a30059e7c441664f3f7e3197897c38438076398e654856
Size

179KB
MD5

6e0d7e5c6ac0e90f342b28abd0f63f30
SHA1

2eca4ebdeb9e3ab3ea752164a9aae7b19c1bbc3a
SHA256

63220bbe271bde6d41a30059e7c441664f3f7e3197897c38438076398e654856
SHA512

aee7624e668720732d2f2ef70fca1dfb2ad9ea3a713de6aa5b04e80a1c72555f5a9ed58a035b0a6fab482190a251305f50bbcd4b623674cecf14aeb2be51b4c9
SSDEEP

3072:OsRI1OxsvM3G59lAVFNFtOGbpN0wYPFQeDYlVcMxjDbCfvX:vRIgxsE3yoVttfcwYdQAYfx/2fvX

Score

N/A

Malware Config

Signatures

Office document contains embedded OLE objects 1 IoCs

Detected embedded OLE objects in Office documents.

resource	yara_rule
sample	office_ole_embedded

Files

63220bbe271bde6d41a30059e7c441664f3f7e3197897c38438076398e654856
.exe windows x86

606438ad395218edd7d1e573b6fbcf4a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegSetValueExA

kernel32

AddAtomA
CopyFileA
ExitProcess
FindAtomA
FindResourceA
GetAtomNameA
GetModuleHandleA
GetProcAddress
LoadResource
LockResource
SetUnhandledExceptionFilter
SizeofResource
VirtualProtect
VirtualQuery

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_iob
_onexit
_setmode
abort
atexit
atoi
fclose
fopen
fread
free
fseek
ftell
fwrite
getenv
malloc
memcpy
rewind
signal
strcat
strtok

shell32

ShellExecuteA

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ