Overview
overview
10Static
static
10Challenge_...m.docx
windows7-x64
4Challenge_...m.docx
windows10-2004-x64
1Challenge_...1.docx
windows7-x64
4Challenge_...1.docx
windows10-2004-x64
1Challenge_...y.docx
windows7-x64
4Challenge_...y.docx
windows10-2004-x64
1Challenge_...1.docx
windows7-x64
4Challenge_...1.docx
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Challenge_FIles/Employee_W2_Form.docx
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Challenge_FIles/Employee_W2_Form.docx
Resource
win10v2004-20230831-en
Behavioral task
behavioral3
Sample
Challenge_FIles/Employees_Contact_Audit_Oct_2021.docx
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
Challenge_FIles/Employees_Contact_Audit_Oct_2021.docx
Resource
win10v2004-20230831-en
Behavioral task
behavioral5
Sample
Challenge_FIles/Work_From_Home_Survey.docx
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
Challenge_FIles/Work_From_Home_Survey.docx
Resource
win10v2004-20230831-en
Behavioral task
behavioral7
Sample
Challenge_FIles/income_tax_and_benefit_return_2021.docx
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
Challenge_FIles/income_tax_and_benefit_return_2021.docx
Resource
win10v2004-20230831-en
General
-
Target
mshtml.zip
-
Size
262KB
-
MD5
75a28db68a020da28cf223010f7c9f9c
-
SHA1
361aa10961eed91b277ffea70641ed6435550d7d
-
SHA256
31475717735f9aee20def2a4044b42a52cb92e8cf885b92a042099a273688135
-
SHA512
6fbe84b932773d0e0f7b12ddcbb4d2b6f802036f71f42f95b65bed7d3a262db3609bbbc4ee8c54a5ee86c5e952da059bba1fd99ac532c07401a3bf98068f3964
-
SSDEEP
6144:dem485iuNrJhuJGd0AkfX+Yk3xonVBio57pMN+UM8iNuiYwLGZTqUdJP+TDu:dempTJAQd0AmOX3mVBp1MN5Ri/YeGZTl
Malware Config
Extracted
arsenal.30cm.tw:1212/word.html
http://175.24.190.249/note.html
http://trendparlye.com/wiki0509.html
http://hidusi.com/e8c76295a5f9acb7/side.html
Signatures
Files
-
mshtml.zip.zip
Password: infected
-
Challenge_FIles/Employee_W2_Form.docx.docx office2007
-
Challenge_FIles/Employees_Contact_Audit_Oct_2021.docx.docx office2007
-
Challenge_FIles/Work_From_Home_Survey.doc.docx .doc office2007
-
Challenge_FIles/income_tax_and_benefit_return_2021.docx.docx office2007
-
tools/numbers-to-string.py.py .sh linux
-
tools/oledump_V0_0_60.zip.zip
-
contains_pe_file.yara
-
decoder_add1.py.py .sh linux
-
decoder_ah.py.py .sh linux
-
decoder_chr.py.py .sh linux
-
decoder_rol1.py.py .sh linux
-
decoder_xor1.py.py .sh linux
-
maldoc.yara
-
oledump.py.py .sh linux
-
plugin_biff.py.py .sh linux
-
plugin_clsid.py.py .sh linux
-
plugin_dridex.py.py .sh linux
-
plugin_hifo.py.py .sh linux
-
plugin_http_heuristics.py.py .sh linux
-
plugin_jumplist.py.py .sh linux
-
plugin_linear.py.py .sh linux
-
plugin_msg.py.py .sh linux
-
plugin_msg_summary.py.py .sh linux
-
plugin_msi.py.py .sh linux
-
plugin_office_crypto.py.py .sh linux
-
plugin_ppt.py.py .sh linux
-
plugin_str_sub.py.py .sh linux
-
plugin_stream_o.py.py .sh linux
-
plugin_stream_sample.py.py .sh linux
-
plugin_vba.py.py .sh linux
-
plugin_vba_dco.py.py .sh linux
-
plugin_vba_routines.py.py .sh linux
-
plugin_vba_summary.py.py .sh linux
-
plugin_vbaproject.py.py .sh linux
-
plugin_version_vba.py.py .sh linux
-
vba.yara
-
tools/re-search.py.py .sh linux
-
tools/reextra.py.py .sh linux
-
tools/reextra.pyc
-
tools/xmldump.py.py .sh linux
-
tools/zipdump.py.py .sh linux