Behavioral task
behavioral1
Sample
d53533af17c59740a5d3a823c6457074ac934705f41a174790d4edfbaa00fe38.xls
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d53533af17c59740a5d3a823c6457074ac934705f41a174790d4edfbaa00fe38.xls
Resource
win10v2004-20240226-en
General
-
Target
d53533af17c59740a5d3a823c6457074ac934705f41a174790d4edfbaa00fe38.zip
-
Size
685KB
-
MD5
423bfb16dc5cb8c12cfb0a981f91e8f2
-
SHA1
2fc701962157c8ec400d3a283c3b82ab6e0ecd28
-
SHA256
6a3521b62054ef39513379754084491e8d0f6e789285fca78f89c920ce51150d
-
SHA512
c2d25d6c76443b2dfc6485884bbf6adf74688355339782769694801a28bdffcff040fb4557ed62d9a9718e3c3264673af8caf4ccbd5685d29c5ec5d81be59da6
-
SSDEEP
12288:+/e8lOrGpLwwGgxEhRkEGGOuQfk4Ujdf62YgoJCNA0apY7lMyRkTV0zgvgEM:AxOrGpECxiGGOugkf5y2YTWAvY5Pkvvu
Malware Config
Signatures
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule static1/unpack001/d53533af17c59740a5d3a823c6457074ac934705f41a174790d4edfbaa00fe38.xls office_macro_on_action -
resource static1/unpack001/d53533af17c59740a5d3a823c6457074ac934705f41a174790d4edfbaa00fe38.xls
Files
-
d53533af17c59740a5d3a823c6457074ac934705f41a174790d4edfbaa00fe38.zip.zip
Password: infected
-
d53533af17c59740a5d3a823c6457074ac934705f41a174790d4edfbaa00fe38.xls.doc .xls windows office2003
ThisDocument
ExtCollection
frmAbout
frmConfigTables
frmEditVariables
frmHelpID
frmMedTraceSettings
frmReqKey
frmReqRea
frmRiskEvaluation
frmUpdateFieldError
mbReqKeyReqRea
mbCommandBar
mbConfigTables
mbCoverPage
WordWrapper
mbCV_RiskEvaluation
mbEditVariables
ViewResetter
mbWindowsAPI
mbGlobalFunctions
mbHelpID
mbFunctions
mbImportData
mbInitDocument
mbReviewReport
mbCV_RiskClass
mbUpdateFields
mbCodeReview
mbNormal
mbReviewReport1
mbMedTraceOutput
mbProperties
mbSortTorAndTorr
mbUncName
mbGlobalDefinitions
mbHelpLinks
mbInsert
mbMenus
mbLandscape