Errors
Reason
office: non-rc4 encrypted document not supported
General
-
Target
5b4314edaf2c1bc2e8edb57d84d9249ec97980bbf2d345859f66351d40995305
-
Size
326KB
-
MD5
ca26eca7f64640e06cc8a3f76088aad9
-
SHA1
90b59f90ecdbdb7ad6fd0441323c4168f940c71f
-
SHA256
5b4314edaf2c1bc2e8edb57d84d9249ec97980bbf2d345859f66351d40995305
-
SHA512
402e026912d0ea14318260395b6491efefa755a1b24bf69456f3670b783e1bf8a07bf11d33946d27438b3a4d32974e70f9783f89441d3fa8a1e40e9c2ef7252b
-
SSDEEP
6144:VV/1r2P3sbf5DjL9RJCo+92/M4hoZ4UfzpXj7HrtRjZ5xFTQqOlTXEjnKW4:VV/ucfdfN+4/M4hobfh7jj7xFTQ5Gn/4
Score
10/10
Malware Config
Signatures
-
Azorult family
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
Files
-
5b4314edaf2c1bc2e8edb57d84d9249ec97980bbf2d345859f66351d40995305
-
stage1-macro.xls
-
stage2-decoded-vbs-cleaned.txt
-
stage2-decoded-vbs.txt
-
stage2-encoded-js.txt
-
stage3-decoded-vbs.txt
-
stage3-encoded-js.txt
-
stage4.ex_
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections
-
stage4.txt
-
stage5-azorult-blob.txt
-
stage5-azorult.dll
Headers
Sections
-
stage5-loader-base64.txt
-
stage5-loader-cleaned.dll
dae02f32a21e03ce65412f6e56942daa
Headers
Imports
Sections
-
stage5-loader-powershell.txt
-
stage5-loader.dll
dae02f32a21e03ce65412f6e56942daa
Headers
Imports
Sections