Behavioral task
behavioral1
Sample
606d8dcf2d97b0564a343b0c1aabcced8375aa3549865eb7b4ddec6f3d3460ab.doc
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
606d8dcf2d97b0564a343b0c1aabcced8375aa3549865eb7b4ddec6f3d3460ab.doc
Resource
win10v2004-20240426-en
General
-
Target
606d8dcf2d97b0564a343b0c1aabcced8375aa3549865eb7b4ddec6f3d3460ab.doc
-
Size
94KB
-
MD5
bedcbebf4b5528038773821de474f54b
-
SHA1
4843913beb5d36411727c0609c9644ae92ca3ad1
-
SHA256
706092b3ae8b7c0f4dc464da5de15f96093ac52246e1b14194777827a84c49f1
-
SHA512
c84376046bd2b1793f4db07fa3352530fd26bdf9b87d928511756acfbf18b57601551a3eb36fdbf9f0e70faad04299454b272dcfea90f6b8f83583e100a94642
-
SSDEEP
1536:aovk55FkF5KApbgaviiKeAa02xSPaG9STDw3zW14nr/BfaN:nvqFkF5KSbRvIej02xYA4W1O/Bf8
Malware Config
Signatures
-
Document created with cracked Office version 1 IoCs
Office document contains Grizli777 string known to be caused by using a cracked version of the software.
resource yara_rule sample grizli777_cracked_office
Files
-
606d8dcf2d97b0564a343b0c1aabcced8375aa3549865eb7b4ddec6f3d3460ab.doc.doc windows office2003