Extracted

• • Target

    Bazar.xlsb

  • Size

    289KB

  • MD5

    3b409c892001c72d4b1be7786cedf010

  • SHA1

    8c3c7e4f570ab74b02003f0befe691a34c29e0d2

  • SHA256

    32b9ed5ed7f0adfc8f39a6300e4fe0831a60c2b4e4631a4d6f7e96ee2b9ff40f

  • SHA512

    8c229ee0831feb17e600fe5aa849d1887682746c9e61d4bd5fd8cce5623b1798d4691c112653da50ec292ac2d7d4452ed1ae961d13971aafae1c69addbfad2c9

  • SSDEEP

    6144:J9GIZGd38S3knv1D8LtYOKlJbAuxcM4SPtDr3Dvyh:J9GmGd38XvAtjuy+P3Dv4

  Score

  10^/10

  upxnloaderloader

  • Nloader

    Simple loader that includes the keyword 'campo' in the URL used to download other families.

    loadernloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Nloader payload

  • Blocklisted process makes network request

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  behavioral1behavioral2