General
-
Target
e05cfdcd11105776fb13edd620795551.bin
-
Size
3.6MB
-
MD5
d8029452fd5c4f3d37810cf48344f50a
-
SHA1
cfc2911ddeb3ac6051f194a5086f94b4ed1b2a1b
-
SHA256
a3e76ecc8bb072355f3007af38d7645b880c9c9572cf7873bacefa6376d6495c
-
SHA512
a65e8fda4e4b160fcd53c1690f966bccc7ee36ec2e68bc32a3ad607e3a778550da94b38a4fa353c841e6e37a632738ad2ca221a4e489fa1cb49169ac3cdf2b87
-
SSDEEP
49152:+MFBGH5UUt9KPUKgPbjcwbAvH8iJ67euEPxKddjh9dYYSRyflvpOksHAv1e2e/HN:+M/SKifPb4wbAzJ3wF001y/1HP
Score
10/10
Malware Config
Extracted
Family
crimsonrat
C2
204.44.124.81
Signatures
-
Crimsonrat family
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
-
Suspicious Office macro 1 IoCs
Office document equipped with macros.
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
e05cfdcd11105776fb13edd620795551.bin
Password: infected
-
da298e4d09a9e151c6bf60e8ebfdd8fc2e633d078c705db768e3284acdad0678.zip
Password: infected
-
[Content_Types].xml
-
_rels\.rels
-
ppt\_rels\presentation.xml.rels
-
ppt\embeddings\oleObject1.bin
Password: infected
-
oleObject1.zip
Password: infected
-
oleObject1.bin
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections
-
ppt\embeddings\oleObject3.bin
-
ppt\vbaProject.bin
Module1