General
-
Target
b8d2a5f16ea925365b077d763e79ac0ced60b7e22ad16307e2ccc73a4a5a05fe
-
Size
80KB
-
Sample
221128-vabhkaaa62
-
MD5
0c98a7e39b0d9a0cb338faee3901182b
-
SHA1
32df1ab85a1aaaeadc2c859b8053dce54b28ab9e
-
SHA256
b8d2a5f16ea925365b077d763e79ac0ced60b7e22ad16307e2ccc73a4a5a05fe
-
SHA512
609448e7d4079c625e3b7a54666c1ca799db4d3d31e96d5e5d806aee17f11721cba1e210c3aefc779410ff6652f4650370468a3b0a948a279ee1fb4875d5e038
-
SSDEEP
768:G6Z7UW+H1tVBhb0Df/EJTfDrrbsjftyGWmVQ02DKXJru9TWPi7pXmVhGvbkR:uJH0DUJTfDrrg73HJruZwnh+2
Behavioral task
behavioral1
Sample
b8d2a5f16ea925365b077d763e79ac0ced60b7e22ad16307e2ccc73a4a5a05fe.doc
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b8d2a5f16ea925365b077d763e79ac0ced60b7e22ad16307e2ccc73a4a5a05fe.doc
Resource
win10v2004-20220812-en
Malware Config
Extracted
http://savepic.su/5339121.png
http://91.194.254.213/us/file.jpg
Targets
-
-
Target
b8d2a5f16ea925365b077d763e79ac0ced60b7e22ad16307e2ccc73a4a5a05fe
-
Size
80KB
-
MD5
0c98a7e39b0d9a0cb338faee3901182b
-
SHA1
32df1ab85a1aaaeadc2c859b8053dce54b28ab9e
-
SHA256
b8d2a5f16ea925365b077d763e79ac0ced60b7e22ad16307e2ccc73a4a5a05fe
-
SHA512
609448e7d4079c625e3b7a54666c1ca799db4d3d31e96d5e5d806aee17f11721cba1e210c3aefc779410ff6652f4650370468a3b0a948a279ee1fb4875d5e038
-
SSDEEP
768:G6Z7UW+H1tVBhb0Df/EJTfDrrbsjftyGWmVQ02DKXJru9TWPi7pXmVhGvbkR:uJH0DUJTfDrrg73HJruZwnh+2
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-