Behavioral task
behavioral1
Sample
cd45a48b53217ad29710b86557d6c2a0f55bf6c595e3d6d32d8d0a5bfd302247.doc
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
300 seconds
General
-
Target
cd45a48b53217ad29710b86557d6c2a0f55bf6c595e3d6d32d8d0a5bfd302247
-
Size
1.6MB
-
MD5
38f6cc4f7199742424ca69a760435bd6
-
SHA1
5cb81942a601dfa293b22361538b7c011e601b84
-
SHA256
cd45a48b53217ad29710b86557d6c2a0f55bf6c595e3d6d32d8d0a5bfd302247
-
SHA512
a736baa43f6dd661490bfa855a97a35228360d4e8f914d3015ff447160988dd5627ffe85e3ab38497401da49b32d4b7080198ac5677ed7685cae736920f0ad64
-
SSDEEP
12288:K3Xn4tkUMMlkl0uZrw5P22EqYLUveVeo86YYJNuVeSDTKtGxaKAKKK:KnJkkl0u2P2jUvS/6kNuVT6ExaKJKK
Score
8/10
Malware Config
Signatures
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule sample office_macro_on_action -
resource sample
Files
-
cd45a48b53217ad29710b86557d6c2a0f55bf6c595e3d6d32d8d0a5bfd302247.doc windows office2003
ThisDocument
wwiEWizard
wwiEBack
wwiECheck
wwiEClose
wwiEDefault
wwiELabelWizard
wwiEInsertSym
wwiECtrlS
wwiEError
wwiEEvaluate
wwiEEditSymPhr
wwiEEditGroup
wwiEDefineRGroup
WWIELabel
wwiELabelCallWizard
frmSrnNumeric
wwiELib
wwiELibDialog
wwiELibDll32
wwiELibFile
wwiEOleSrvDynText
wwiELibLang
wwiELibOle
wwiELibText
wwiEOleGenerate
wwiEOleXpra
wwiEOleDynText
wwiEOleDynText_Graphic
wwiEOlePrintLabel
wwiEOleGraphic
wwiEOlePrint
wwiEPosFrame
wwiERfc
wwiES
wwiEScanSym
wwiESetup
wwiEShowAndHide
wwiEStore
wwiESymChange
wwiESymInfo
wwiESymLOff
wwiESymLOn
wwiETextReset
wwiEVersion
AutoClose
wwiEOleSrvGraphic
wwiELabelInsertNum
wwiIMakeMenue2
wwiIExportMakros
wwiEInit
wwiESetEnv32
wwiEInsCondTxt
wwiEInsertPhrase
wwiENNGroup
wwiWordXP
clsDebug
wwiIImportMakros
wwiWord2007
wwiEOleCompare
wwiWordToPDF