Behavioral task
behavioral1
Sample
emotet_64.doc
Resource
win7-20240508-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
emotet_64.doc
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
8a0337f884939e07ffdda1c7ffeadaab_JaffaCakes118
-
Size
104KB
-
MD5
8a0337f884939e07ffdda1c7ffeadaab
-
SHA1
fe4221509f5e037eedb6c58dc189cc46951dd38f
-
SHA256
08aabba1a90632dd3dea39c93e4ee8362e000fa5df074b10c6c4d2e9fbab54d2
-
SHA512
36a958c55f7dbd0d0f1e52a7a46b4a3dc5879ee893f97241c3b60408910eb1ac9c5d6b24e85ec13908cab20eb464bdf9afddc7b86b8bd32ace550b7e1d3e0db8
-
SSDEEP
1536:qG4PeLNPQxRZEF1VI3KyV2FryJammLBttYvaOfb3fwsege0mZrDIi6CD3t1beb:/4ENURE/wI/3lNM3osege0mZre+beb
Score
8/10
Malware Config
Signatures
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule static1/unpack001/emotet_64.doc office_macro_on_action -
resource static1/unpack001/emotet_64.doc
Files
-
8a0337f884939e07ffdda1c7ffeadaab_JaffaCakes118.zip
Password: infected
-
emotet_64.doc.doc windows office2003
ThisDocument
FTjPoQnplP
PziOTljSRSV
wAjUBNOq
whcXHVZ