General
- Target 32fd7d18f22fdbe8e99c5bd1e6ac50f74b81cd146e7b45f80776e799edb89c83
- Size 4.4MB
- Sample260910-22gl8axcjf
- SHA256 32fd7d18f22fdbe8e99c5bd1e6ac50f74b81cd146e7b45f80776e799edb89c83
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
http://127.0.0.1/1.exe
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://www.microsoft.com/en-us/download/details.aspx?id=103391
-
exe.dropper
https://download\.microsoft\.com/download/[^"'\s>]+/GetHelpCmd_[0-9]+\.zip
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://login.microsoftonline.com/common/oauth2/nativeclient
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://login.microsoftonline.com/common/oauth2/nativeclient
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://officecdn.microsoft.com/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6
-
exe.dropper
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60
-
exe.dropper
http://officecdn.microsoft.com/pr/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114
-
exe.dropper
http://officecdn.microsoft.com/pr/b8f9b850-328d-4355-9145-c59439a0c4cf
-
exe.dropper
https://docs.microsoft.com/en-us/officeupdates/update-history-office365-proplus-by-date
Targets
-
- Target 32fd7d18f22fdbe8e99c5bd1e6ac50f74b81cd146e7b45f80776e799edb89c83
- Size 4.4MB
- SHA256 32fd7d18f22fdbe8e99c5bd1e6ac50f74b81cd146e7b45f80776e799edb89c83
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Loads dropped DLL