NovoNordiskPurchaseOrder[.]xls

Resubmissions

14-08-2024 08:55

240814-kvrp6stbph 7

14-08-2024 08:48

240814-kql9wsshnf 7

Sharing

Copy URL

Twitter E-mail

General

Target

NovoNordiskPurchaseOrder.xls
Size

17KB
MD5

099ec9d4290253ab7de142d541185bcf
SHA1

c5453c57f22105fe28cdf3241c263b69644fc3e7
SHA256

c867a84298f16a3ee66b52ca6f6d28cad18bb12446b6cc68440e7ac50199ec14
SHA512

d65b21e7608113006acedfa2cf7d17abc5bcd14e07a8c04d67a6103fd7fb690b7bbbe5c93621ddd1bb47d6ab9ba285e362aca1926649be4d5ce3ac25b353b5a1
SSDEEP

192:i7hoPUWCW69EyKkgt1dIJ6G1EfeUIyzizkUNSPJfS2lX52E3fpAL:i7Vr0yngvHFfeDzk1PT1A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NovoNordiskPurchaseOrder.xls

Files

NovoNordiskPurchaseOrder.xls
.xll .xls windows:1 windows x64 arch:x64

643080cd633858bc89a28aa73d95ed9f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mswsock

SetServiceW
getnetbyname

shlwapi

SHLoadIndirectString
SHRegisterValidateTemplate
PathIsNetworkPathW
PathFindFileNameW
PathIsFileSpecA
StrFromTimeIntervalW
StrFormatByteSizeA
StrCSpnIW
PathIsNetworkPathA
PathCommonPrefixW
PathIsSameRootA
StrFormatKBSizeW
PathIsLFNFileSpecW
StrCatW
PathRemoveExtensionA
StrRChrIA
StrSpnA
PathRemoveArgsW
UrlApplySchemeW
UrlCreateFromPathA
UrlIsOpaqueA
StrNCatA
AssocGetPerceivedType
SHRegQueryInfoUSKeyA
GetAcceptLanguagesA
SHEnumKeyExW
SHRegWriteUSValueW
SHRegSetUSValueA
StrCmpIW
PathGetArgsW
IntlStrEqWorkerW
SHDeleteEmptyKeyA
StrRChrW
SHDeleteOrphanKeyW
UrlGetLocationA
PathUnquoteSpacesW

ftsrch

IsValidIndex
ScanDisplayText

iphlpapi

GetFriendlyIfIndex
GetNumberOfInterfaces
DeleteIpForwardEntry
InternalGetIpNetTable
GetIpStatisticsEx
IcmpSendEcho2
NTTimeToNTPTime
IcmpSendEcho
InternalGetIpForwardTable
IcmpCloseHandle

Exports

Exports

xlAutoOpen

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 119B

IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

643080cd633858bc89a28aa73d95ed9f

Headers

DLL Characteristics

File Characteristics

Imports

mswsock

shlwapi

ftsrch

iphlpapi

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 4KB

.text Size: 4KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 119B

.reloc Size: 512B - Virtual size: 8B

.text
Size: 7KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 4KB

.text
Size: 4KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 119B

.reloc
Size: 512B - Virtual size: 8B