Extracted

• • Target

    uk1108.xlsm

  • Size

    56KB

  • MD5

    fed5ca25e44378f5d0855ff53471a0fd

  • SHA1

    07e15c01242644b8ba067e19dc5e2cda116ad66d

  • SHA256

    c99d8022ba102c4152c0bb445a4cb90616bf77d9ad329432cacbe1243068bd5f

  • SHA512

    2bbf20c069db84df6fc6bba863e5942b4c4289b026ba23dd1b8dc88078871f1e891fa6828d97c03af03f465af8499080b31150f2574298af500517821730be28

  • SSDEEP

    768:m9x5Mu+xWpt1J3S5f3v4Jfa3ODVs3KnooaRHIuZVvgEeqI54f5Wl:eHMu+xWLC5/wJi3eVsdtLVvm+0l

  Score

  10^/10

  bumblebee0411rtrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2