Overview

overview

10

Static

static

8

43ad1f8394...ea.xls

windows7-x64

10

43ad1f8394...ea.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    43ad1f8394fc6dde60e7e595e228ca5ac2187e60837d3bb3571bf7ea733704ea

  • Size

    95KB

  • Sample

    241120-1fdg1atcqh

  • MD5

    411e43bb13d70066ad47e8ecbfb7f441

  • SHA1

    20201000116c31252a0c6ae36877ddedf05fe5d6

  • SHA256

    43ad1f8394fc6dde60e7e595e228ca5ac2187e60837d3bb3571bf7ea733704ea

  • SHA512

    42c438a04078a6a443e887fb19a16d5eee70cda3e2c20cde6277cf98bea0a017d755f484eb61d1172df4d2064491f5dc674372185bffbe658330df7f3536de45

  • SSDEEP

    1536:UkKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4HuS4hcTO97v7UYdEJmc:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgq

Score
10/10
discoverymacroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://cointrade.world/receipts/0LjXVwpQrhw/
xlm40.dropper

http://www.garantihaliyikama.com/wp-admin/jp64lssPHEe2ii/
xlm40.dropper

http://haircutbar.com/cgi-bin/BC3WAQ8zJY4ALXA4/
xlm40.dropper

http://airhobi.com/system/WLvH1ygkOYQO/

Targets

    • Target

      43ad1f8394fc6dde60e7e595e228ca5ac2187e60837d3bb3571bf7ea733704ea

    • Size

      95KB

    • MD5

      411e43bb13d70066ad47e8ecbfb7f441

    • SHA1

      20201000116c31252a0c6ae36877ddedf05fe5d6

    • SHA256

      43ad1f8394fc6dde60e7e595e228ca5ac2187e60837d3bb3571bf7ea733704ea

    • SHA512

      42c438a04078a6a443e887fb19a16d5eee70cda3e2c20cde6277cf98bea0a017d755f484eb61d1172df4d2064491f5dc674372185bffbe658330df7f3536de45

    • SSDEEP

      1536:UkKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4HuS4hcTO97v7UYdEJmc:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgq

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks