Overview
overview
10Static
static
8e0da81eb-d...4d.eml
windows7-x64
6e0da81eb-d...4d.eml
windows10-2004-x64
3INVOICE N ...03.zip
windows7-x64
1INVOICE N ...03.zip
windows10-2004-x64
1INVOICE YV...03.doc
windows7-x64
10INVOICE YV...03.doc
windows10-2004-x64
10email-html-1.html
windows7-x64
1email-html-1.html
windows10-2004-x64
1Behavioral task
behavioral1
Sample
e0da81eb-db96-c3ed-0345-c4eb79cf184d.eml
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e0da81eb-db96-c3ed-0345-c4eb79cf184d.eml
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
INVOICE N KCJX347486 08-03.zip
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
INVOICE N KCJX347486 08-03.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
INVOICE YVCA3529703 08-03.doc
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
INVOICE YVCA3529703 08-03.doc
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
email-html-1.html
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
email-html-1.html
Resource
win10v2004-20230220-en
General
-
Target
e0da81eb-db96-c3ed-0345-c4eb79cf184d.eml
-
Size
954KB
-
MD5
51ca6e3262ea4aadd81a3f678150a381
-
SHA1
70a2b69a7647b01015d035497e79e45858cf9124
-
SHA256
c573e9c33d9d195968de3b77174e674d800200893aa2f3b7e4b45bc16b6e0321
-
SHA512
834759f4a7cfe2979911618094c06c3a467da6e16a22fad01f123ce38c2e5f74d651503552fd30939d3b2c7018056e9f06147f676c8467c300ec09fe9b3f2430
-
SSDEEP
6144:zo+yc09O3wEAL8OTdeFzacREjyHUlfcLz/ksKSJ:zo7NbdYOReFzewUlfEzYSJ
Malware Config
Signatures
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule static1/unpack002/INVOICE YVCA3529703 08-03.doc office_macro_on_action -
resource static1/unpack002/INVOICE YVCA3529703 08-03.doc
Files
-
e0da81eb-db96-c3ed-0345-c4eb79cf184d.eml.eml
-
http://www.nityo.com/
-
-
INVOICE N KCJX347486 08-03.zip.zip
-
INVOICE YVCA3529703 08-03.doc.doc windows office2003
ThisDocument
Module1
-
email-html-1.txt.html