Behavioral task
behavioral1
Sample
f327a4de761bb0d7f14c26ebaa092be428f481c1f7c868250f30112ae33fc4c8.xls
Resource
win7-20230220-en
6 signatures
150 seconds
General
-
Target
10505990132.zip
-
Size
680KB
-
MD5
0d3f8a23e4132c397849d53864116ff8
-
SHA1
f7395baced8e684312d55cbf1d6de62a79b7d966
-
SHA256
b6d684d447ed85dca52cc8dc7dc621804cd140ff7ed6d6332e39df8562e0c2e4
-
SHA512
fd03c183160da3b7486c28ffaf3b09705b768931dc4dfe04b6b44eee8bdc82fc454358d8b22a59dc0f07a63d150e9d38f115f514f9000eab72f88de4dcb97035
-
SSDEEP
12288:p3LnBLzhL5WUOdNgYTqzX7gWPNYaC4Ku7AVtP2rtXN+RpDdLOKDPnT4R:ZnBL9tWU+Z+XG+ItP6d+RpDEKDER
Score
8/10
Malware Config
Signatures
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule static1/unpack001/f327a4de761bb0d7f14c26ebaa092be428f481c1f7c868250f30112ae33fc4c8 office_macro_on_action -
resource static1/unpack001/f327a4de761bb0d7f14c26ebaa092be428f481c1f7c868250f30112ae33fc4c8
Files
-
10505990132.zip.zip
Password: infected
-
f327a4de761bb0d7f14c26ebaa092be428f481c1f7c868250f30112ae33fc4c8.xls windows office2003
ThisWorkbook
Data
Res
cUAMeasure
modUtility
gistThat_
cCell
cDataSet
cDataSets
cDataColumn
cDataRow
cHeadingRow
usefulStuff
cJobject
usefulcJobject
usefulColorStuff
regXLib
cregXLib
cStringChunker
restLibrary
cRest
cBrowser
usefulEncrypt
cOauth2
googleWireExample
oauthExamples
googleSheets
UAMeasure
Module1
Sheet1