Behavioral task
behavioral1
Sample
606d8dcf2d97b0564a343b0c1aabcced8375aa3549865eb7b4ddec6f3d3460ab.doc
Resource
win10v2004-20240221-en
Behavioral task
behavioral2
Sample
606d8dcf2d97b0564a343b0c1aabcced8375aa3549865eb7b4ddec6f3d3460ab.doc
Resource
win11-20240221-en
General
-
Target
606d8dcf2d97b0564a343b0c1aabcced8375aa3549865eb7b4ddec6f3d3460ab.doc
-
Size
94KB
-
MD5
144ca265cf777000ebc1ed026141203b
-
SHA1
c7df673e7071140ebb657f6f6ed387d45a0dc68d
-
SHA256
606d8dcf2d97b0564a343b0c1aabcced8375aa3549865eb7b4ddec6f3d3460ab
-
SHA512
91174e21c5d54b30478fa3275a80bdc19f3573363e03e7141e781872c0c4bd770b8e3839c592b00c9586cdc59c384616bea172af90a2972c03bb3b77a7e85141
-
SSDEEP
1536:2FkF5KApbgaviiKeAa02xSPaG9SzW14nr/BfaNevk5bDO3:2FkF5KSbRvIej02xYAzW1O/Bf8ev
Malware Config
Signatures
-
Document created with cracked Office version 1 IoCs
Office document contains Grizli777 string known to be caused by using a cracked version of the software.
resource yara_rule sample grizli777_cracked_office
Files
-
606d8dcf2d97b0564a343b0c1aabcced8375aa3549865eb7b4ddec6f3d3460ab.doc.doc windows office2003