Behavioral task
behavioral1
Sample
c9730b45df6c482ceb7781fc48e9bf0cabb40e5f0f97b24bf36e171c75d6b7ea.doc
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c9730b45df6c482ceb7781fc48e9bf0cabb40e5f0f97b24bf36e171c75d6b7ea.doc
Resource
win10v2004-20230220-en
General
-
Target
6856dda8c64df3104c29c2b06b45022b.bin
-
Size
85KB
-
MD5
a62e2445b3ae3d94ef3cd6ebafa5c6e7
-
SHA1
07ae5a59d2e3ecf74353226b0d95cbe225763de3
-
SHA256
04d57c53300f20e857495adf105c9eae622de1e4d9ecb1af81513f189145cade
-
SHA512
cad403f277641be06c72c33707301209200d0932dd86b1df4b4d4980c7bb5814b64e242b29353843fe65b32ad45e06bb37509846b12f2386b4a66a559bd1ce2b
-
SSDEEP
1536:lV1UZqO+j0YvrzxOojf1cVTixXiCB1GaQeTcdrX74wk8bh9tfbhKIdEYg0O3srRd:Sojj0Ylr1EixhhcZXMwk8PtSwOHZQv
Malware Config
Signatures
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule static1/unpack001/c9730b45df6c482ceb7781fc48e9bf0cabb40e5f0f97b24bf36e171c75d6b7ea.doc office_macro_on_action -
resource static1/unpack001/c9730b45df6c482ceb7781fc48e9bf0cabb40e5f0f97b24bf36e171c75d6b7ea.doc
Files
-
6856dda8c64df3104c29c2b06b45022b.bin.zip
Password: infected
-
c9730b45df6c482ceb7781fc48e9bf0cabb40e5f0f97b24bf36e171c75d6b7ea.doc.doc windows office2003
ThisDocument
Z8U9ZuPRV
y64SMQ7m
i3B8aMjXq