Extracted

• • Target
    Bazar.xlsb
  • Size 289KB
  • SHA256 32b9ed5ed7f0adfc8f39a6300e4fe0831a60c2b4e4631a4d6f7e96ee2b9ff40f
  • MD5 3b409c892001c72d4b1be7786cedf010
  • SHA1 8c3c7e4f570ab74b02003f0befe691a34c29e0d2
  • SHA512 8c229ee0831feb17e600fe5aa849d1887682746c9e61d4bd5fd8cce5623b1798d4691c112653da50ec292ac2d7d4452ed1ae961d13971aafae1c69addbfad2c9
  • SSDEEP 6144:J9GIZGd38S3knv1D8LtYOKlJbAuxcM4SPtDr3Dvyh:J9GmGd38XvAtjuy+P3Dv4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  upxnloaderloader

  • Nloader

    Simple loader that includes the keyword 'campo' in the URL used to download other families.

    loadernloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Nloader payload

  • Blocklisted process makes network request

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  behavioral1behavioral2