General

  • Target

    9686464326.zip

  • Size

    148KB

  • MD5

    9f4a0c4cfc735547052f05f8a7d15a0c

  • SHA1

    36678c65e0fec4f1ae560625a72a55a243152e7d

  • SHA256

    f528f31a2b49ac4ae44140a0e2d4cc44f857b5ee939da6778bbf0d055f3d3699

  • SHA512

    f3a79d93ac7b362dc467ff9bea0c229ed995d5f5d6715708d9eb7d5cbf043247fb8707d7104b1e313b771b0565933849cf1918529ecdcd36f09bc7c99e8347b2

  • SSDEEP

    3072:8xyjvW/Xq0gypzB8ETY+8MHKfDtlKNZmXUCpJzqo:1vWrgyxB/vv6DtlKLEhqo

Score
8/10

Malware Config

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

Files

  • 9686464326.zip
    .zip

    Password: infected

  • 4d32ea49883d23f9cc09c1acce01d5b459fbd56f441989e1ba7877367a28fb10
    .msg
    • http://anair.com/content/koreanair/korea/ko/customer-support.html#cta-large=/gl

    • http://anair.com/content/koreanair/korea/ko/skypass/earn.html#korean-air

    • http://anair.com/content/koreanair/korea/ko/ticket-information.html#korean-dome

    • http://anair.com/content/koreanair/korea/ko/traveling/airport-check-in.html#kio

    • http://anair.com/content/koreanair/korea/ko/traveling/baggage-services.html#not

    • http://anair.com/content/koreanair/korea/ko/traveling/classes-of-service.html#c

    • http://anair.com/korea/ko/footers/Privacy-Policy.html

    • http://bloomvista.co.kr

    • http://book.com/KoreanAir

    • Show all
  • e-Ticket 확인증_95292914.xls
    .xls windows office2003

    ThisWorkbook

    CodeBlock

    ClaModu

    Class7

    Class5

  • image001.jpg
  • image002.jpg
    .jpg