Overview

overview

10

Static

static

8

Form.doc

windows10-2004-x64

10

Form.doc

windows11-ltsc_2024-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    Form.doc
  • Size 266KB
  • Sample260909-alap7azdnf
  • SHA256 93acd143023235b808b9ae5443350183c61e752a9cd25c8d7f6166558ee416f2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://haoyindz.com/wp-content/hiKW/
  • exe.dropper

    http://tay.batt2u.com/cgi-bin/sKobi4/
  • exe.dropper

    http://powerlinkaudio.com/wp-admin/fq5g/
  • exe.dropper

    http://perfectfoodcenters.com/wp-includes/ssLLy/
  • exe.dropper

    http://tatse.de/users/eo/

Targets

    • Target
      Form.doc
    • Size 266KB
    • SHA256 93acd143023235b808b9ae5443350183c61e752a9cd25c8d7f6166558ee416f2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks