Behavioral task
behavioral1
Sample
Ncr.zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Ncr.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
59127688180328585892998__2023-08-03_1113.doc
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
59127688180328585892998__2023-08-03_1113.doc
Resource
win10v2004-20230220-en
General
-
Target
FW Approval require to inward Filler card at Suncity site. .msg
-
Size
687KB
-
MD5
81014a2240e00f1891f3e67610013b68
-
SHA1
fa24c265e2b0ea819f2dd6e136ad27d58f6a80a7
-
SHA256
98bd01d6659ecfa9d21ac0ecad5f0bca6d070866af7b62c9502b3271c2afd887
-
SHA512
7a451ef014e0876146c4372cbc1cccb6f3a437330d7b6584bd8525b32c8b8d4d35ebe70ba830057d990d1a6b08eb43d1ef1018091fc0d13b85b2cc257be7169d
-
SSDEEP
6144:Oy/JNbwmfcuHom8Hz2f//ywiWT8xVTI5wq:OMbPHom8TYyCT8x5I5w
Malware Config
Signatures
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule static1/unpack002/59127688180328585892998__2023-08-03_1113.doc office_macro_on_action -
resource static1/unpack002/59127688180328585892998__2023-08-03_1113.doc
Files
-
FW Approval require to inward Filler card at Suncity site. .msg.msg
-
Ncr.zip.zip
-
59127688180328585892998__2023-08-03_1113.doc.doc windows office2003
ThisDocument
Module1