General
- Target dashboard_user.zip
- Size 7.5MB
- Sample260930-w2xesatwfy
- SHA256 44e651326d7a674a5a958a1e81eb0eb1232e2f00791b5d8cfc7b599569b27794
Malware Config
Extracted
-
ps1
-
exe.dropper
http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
Extracted
-
ps1
-
exe.dropper
http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
Targets
-
- Target PhpWord/Element/AbstractElement.php
- Size 12KB
- SHA256 a24d7f30808a2ec4a939ee9a225d1061680677dffa3acbdb88ac5ff9c45e0ace
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PhpWord/Element/Image.php
- Size 15KB
- SHA256 9ce1a5bd3580e28ba62e6f24cccc80ff237885b61a493c77ab07bbe791c5267b
Score3/10 -
- Target PhpWord/Element/Section.php
- Size 4KB
- SHA256 77ae8d0c28bdfccef25d673c4b9a2e23f01b70befdd78c083a0dfb2a4c0ae740
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PhpWord/IOFactory.php
- Size 4KB
- SHA256 12fe3736d73d1fef0cd5f0658b03f73a142d9579187bf3751e34fab7cabd676c
Score5/10-
Executes a VBScript file via the Windows Script Host.
-
- Target PhpWord/Reader/AbstractReader.php
- Size 2KB
- SHA256 ddc8b746647d7a732432327a1db43d96125c9e05d21c3ab496729fb760936161
Score3/10 -
- Target PhpWord/Reader/MsDoc.php
- Size 99KB
- SHA256 4d52ae975ad02025a8d3dbfa5afdfd8d403c638523d7e619486a15ac60cbe068
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PhpWord/Reader/ODText/Content.php
- Size 9KB
- SHA256 e9dd7d457e5afafbd5ec4edae23946e756737472265e72be11bf32a739fbaba4
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PhpWord/Reader/Word2007.php
- Size 6KB
- SHA256 dfa716818010931ca363d428ede85bae286b58c8e09061c20ac9e32737614221
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PhpWord/Reader/Word2007/AbstractPart.php
- Size 41KB
- SHA256 a4ac3ef381523fa009f3ebe494749d628e2c8e45971d38df4125249f408fa287
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PhpWord/Reader/Word2007/Footnotes.php
- Size 2KB
- SHA256 f960725d137ed0a1094200ae8140dbba957f5f7394cca2300fda0dbb74e65778
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PhpWord/Reader/Word2007/Numbering.php
- Size 4KB
- SHA256 43669f9b469ce9e5f6c7a7ac7b09c1ee138e1cd9cf3c859e2d424d16273eeb06
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PhpWord/Settings.php
- Size 12KB
- SHA256 40308c1cf9bdd96d06735c03fd25bb19423b0eac39de510ea11de55979831276
Score6/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PhpWord/Shared/Css.php
- Size 2KB
- SHA256 1edd6e77a172ebbec097a53c9c3be6266ec3b22a28a9725dee91cc0f14eec668
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PhpWord/Shared/Html.php
- Size 51KB
- SHA256 3437b5409c8821eb6b78f4f580027ecc64eb471cc334800157c193b6c3d316fa
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PhpWord/Shared/XMLWriter.php
- Size 5KB
- SHA256 61444840ddcde8960be640ae416eef3c403487209c4b3b12776db745e2362169
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PhpWord/Shared/ZipArchive.php
- Size 12KB
- SHA256 49f741efd27ed19031dc9c5bd7c47b8f400af7d00f63acb413c9e4e09d29f470
Score3/10