Behavioral task
behavioral1
Sample
Shipping document EXP4052 MAERSK AMAZON.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Shipping document EXP4052 MAERSK AMAZON.xls
Resource
win10v2004-20221111-en
General
-
Target
Shipping document EXP4052 MAERSK AMAZON.xls
-
Size
179KB
-
MD5
3624d3c88fb16885c58cb4be303a54ee
-
SHA1
cad95da7ce88a90c77c23970c587c873c9ae0d4c
-
SHA256
3a1d7aaae74c5112c684b9c10390f922cf52ba8df28c4cf71206e7fb373c3de3
-
SHA512
bacdf21154cb34fac8d0185f9d8ad361183991c51bf5b1ed8e5f6c9f36ccff4bd995bec2008506433e69b8caa32651aed7e77fbe2eda73659905684e4cd19005
-
SSDEEP
3072:Kt9hcuh4t9hcNrhGTDfZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAADB+5IeW0iT2fB:IcuhicNNGXZ+RwPONXoRjDhIcp0fDlaO
Malware Config
Signatures
-
Document created with cracked Office version 1 IoCs
Office document contains Grizli777 string known to be caused by using a cracked version of the software.
Processes:
resource yara_rule sample grizli777_cracked_office
Files
-
Shipping document EXP4052 MAERSK AMAZON.xls.xls windows office2003