Overview

overview

10

Static

static

8

d568deb474...67.xls

windows7-x64

10

d568deb474...67.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d568deb474269b13b60b361b7e7aed101e0578ef26b15319e3891674aa68a767

  • Size

    95KB

  • Sample

    241120-ld2pgsvlfs

  • MD5

    e06c4c012f3fe1d9686d604f53b5e426

  • SHA1

    782d7fd1dc4b6d016b0f2daf3642a6fb7dbea15b

  • SHA256

    d568deb474269b13b60b361b7e7aed101e0578ef26b15319e3891674aa68a767

  • SHA512

    d95c11ac38eb7391aa0526eee85aa9f652a41570c76286be0be2e3ae2bd29faa7c1c20bfcead998a75604b760085ab55a87befc4d071e5cab7b98e097ada00a7

  • SSDEEP

    1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgBHuS4hcTO97v7UYdEJmTq:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgb

Score
10/10
discoverymacroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://atperson.com/campusvirtual/3aAaeSKPaURF/
xlm40.dropper

https://buffetmazzi.com.br/ckfinder/i/
xlm40.dropper

http://atici.net/c/MgEC/
xlm40.dropper

http://www.birebiregitim.net/wp-includes/f/

Targets

    • Target

      d568deb474269b13b60b361b7e7aed101e0578ef26b15319e3891674aa68a767

    • Size

      95KB

    • MD5

      e06c4c012f3fe1d9686d604f53b5e426

    • SHA1

      782d7fd1dc4b6d016b0f2daf3642a6fb7dbea15b

    • SHA256

      d568deb474269b13b60b361b7e7aed101e0578ef26b15319e3891674aa68a767

    • SHA512

      d95c11ac38eb7391aa0526eee85aa9f652a41570c76286be0be2e3ae2bd29faa7c1c20bfcead998a75604b760085ab55a87befc4d071e5cab7b98e097ada00a7

    • SSDEEP

      1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgBHuS4hcTO97v7UYdEJmTq:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgb

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks