SUSP_VBA_OBFUSC_Jul20_1

Rule Info

Name
SUSP_VBA_OBFUSC_Jul20_1
Author
Florian Roth
Description
Detects Stage1 indicators - obfuscated VBA code
Score
75
Reference
Internal Research - Stager Analysis
Date
2020-07-16
Modified
2023-01-16
Minimum Yara
1.7
Rule Hash
11a8fc465f69b85fe2df942dcaac82c8
Tags
['FILE', 'SCRIPT', 'T1027', 'SUSP', 'OBFUS']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
76
Suspicious (< 10 engines)
9
Clean (0 engines)
0

Rule Matches

Timestamp
Positives
Total
Hash
VT
2023-01-03 20:50:15
26
60
196a4c8405c8ff99b493ebfc8fa759a5d6296b5c22310406900a3bbc722bd45e
2023-01-03 11:14:31
25
61
a354efc12950a27395339aa88d8c5e4c6ebcff94485612af5b28bc860e8b52b7
2022-12-21 13:10:19
25
60
f94fa79ec4b849540c5891064d58f61e142f33a4f588ed7954566c2ddf7a90ac
2022-11-13 16:40:19
27
60
8c5c5a0fc57023e42cf44f5781ed0433d5896a7bc6c7b6fdd44ac63699c1c952
2022-11-07 10:05:14
21
48
9abd0bb9897ac42c2a824793c62f33f5a5e36ce593f0d674bc0b4f8aeddcdbe3
2022-11-07 06:56:17
17
46
6a1dfa964689477d71fe7af806ffd0d13debdc6c1e30aab5a5aea1f5be85299e
2022-11-06 15:19:45
28
61
7e5be6cd855aea9f2555abcbe374738f58a4b6d3ec399804813f679ccce11588
2022-11-06 15:15:00
30
61
a85a84f288c0339b72c3e86588a2ef330a0c53cd4e5812462f706f68e788b846
2022-11-06 14:41:44
29
61
f42ed9b0c8508cb42287dba8a5c4ee8f132d4b0d18458ac8ebc1284947af4fce
2022-11-06 14:41:00
26
61
4460a0c1b6228a0dd0557d5aab22c10426040c6bb963bf63b9f8f8ccde363a89
2022-11-06 14:34:30
27
61
60a89c1fbe4e07152308d3ff8a514b09fe94bc67bade3f89f5dc7ac75e47e943
2022-11-06 14:34:25
25
61
fa28bb92a74eab8dc63b29e474f23f53930053ee036b7d00a93df7439d4cb253
2022-11-06 14:34:07
28
61
0780c2eda1caf76f43a18e6e11c1eb0a85bc15ca630d7f641ab2262b63c49495
2022-06-02 01:35:18
21
57
72cb337560513a7dc3bad0a21c2280ac94db8fbdc96349d913bd09709486345c
2022-06-01 01:28:20
20
58
508d516975d89dc0afe03db7eaccb266023042c2cf277c5b0740697cd7934278
2022-05-14 01:28:24
19
59
3d44db06017c517e7b31af4b9da74f9c4e9ba713d77ef1f1242a27708dd530c6
2022-05-14 01:25:46
11
59
0c75d0847809eb83ff8d2ba569a2a762517e610d994be641e9f10bcb4457024b
2021-12-30 01:27:59
25
58
1b30d432a173c580e9c49c492974bb046d9702bb53a80eccd5c4137ecf9ef839
2021-11-10 13:07:46
22
56
b1612157e7820d7895f8edcfddc9a0c1f6f4f834c0e8ff3e1d432e9859b45417
2021-01-08 20:08:29
21
59
813a626d4dc0751fde0e99ea24b4f1893c97f0a7f74b47ec7328151dbfa2f2ac
2020-12-29 14:43:34
27
60
6edcaf40b139316e10d1a505c2f27d14e167d6bcf79da743b40ca34e57a1af67
2020-12-21 17:05:13
18
59
c59fab8a51ee28700ebbb67c55014828cf0f62c80fb0d027ab4db977e0c03cc7
2020-10-22 10:55:51
26
59
96bd66aedb565c6d29e60d7e7880047749abcd1cfa2d7b27f612b7b32038ede5
2020-10-02 16:51:17
28
59
2cc33394a01bb3af0e48d0ccb71037c39f142fb22a7ed2ac40bc0860147da1a8
2020-10-01 16:17:49
24
59
761efb3aa73bc9ee212c49b374a0f8a363856a791cd7c873bf47959f2565f5a8
2020-09-30 17:24:55
20
59
189ebcdcc77ccf27ab7c72131799ad914c1326df526704aeeb5229311eb75faa
2020-09-22 19:52:02
17
60
89f140471430428408edffc8ed10486238edcefbca74955f891ce8193c02132d
2020-09-17 14:27:14
13
56
5c406001ae0a73520be03fb35e32364b6faf7cdc5a714169cde1d783469ae223
2020-09-16 17:15:48
13
56
35cd349863fc7ce3e1da6d53cf0b8dc970b76bb25b5acd07e997067d63f1f1da
2020-09-16 08:23:31
23
56
bd104d65a79f1f7936ac0e53bc8f54f568ad7ba4c852801fc9f63db00cc57724
2020-09-15 21:53:59
13
57
2a47710a8d6a83591b63723819a207dc8a5ce66c571786f44942dec5dd94ead2
2020-09-15 20:24:25
14
58
8d921fccefab6901a2863c4a96c09125a681875a062280a329c1a0887c12ac85
2020-09-15 19:47:06
13
54
b5864ad558f6d6e0e9287e0f5b245fed47016a09d1386732c2049e6f8176493e
2020-09-15 15:57:10
13
56
39cba2c4b84f0487551007ec2cdc03492cb010b7cf513c2e146902bd6810d717
2020-09-15 13:22:41
6
54
34a78d9e56aae3a8c96742430bfdd41a293e0aa3e4da3b62ebad7b64a58895e4
2020-09-14 21:24:20
10
57
6c9960468badca2ecff6dc34d28b441f2e24276e0efae66c56b2a2938f467d5c
2020-09-14 17:37:34
10
57
8c1574b3733d8a71cde947702bc65bab41267c38c7aeb016a601fe3881932bc7
2020-09-14 17:09:45
9
55
5c93e2d8e2c6a0be33377d0d374c0f7f03c9ddb6de360a92780faf184e9affc7
2020-09-14 15:28:01
10
57
1dba2064e7290c1896d560ff266a18cb6bd9b7e82aad50ddcbe2afde3e43c53e
2020-09-14 14:26:30
11
58
06782a85c4bcec3a7e09a96d269d6eb46baba09e998fbaad098bb3ca6e4f651b
2020-09-14 13:45:18
10
58
2619857e78e5697e59d9c9799b548f2b154d8c7ead180b399a1f5dc87507d4f4
2020-09-14 12:31:40
11
59
ca01e30a66064d4cf782f040aca4b59e3555aae99c6483dc4fb4cdfb2590c06c
2020-09-14 12:26:29
10
59
f6cb2ffe73e87a5d0053ca599d203d3dbc187d65b434d4c7c649c51ba2689505
2020-09-14 12:20:17
10
57
a1bfd39eb6057b5797ca04c30d5ca65641585e72ecdfdd8e0c1ac24d126b4056
2020-09-14 11:09:57
10
58
28b811e737ec718f5c36cf05df89da00f48e4e088756e11564c15fe683702964
2020-09-14 09:55:40
2
58
9f1d77dacee045731ee5ff9539060528ce01c5db3f7b99b4f7ac68687beab966
2020-09-14 09:45:30
9
56
15a61df21dc514fc4e935bb1e267134265f2c70aa167f03389c4f1a5b5a750d9
2020-09-14 09:23:46
9
56
9b4dc4c27bbba4e9215b17cddfc80ee3581f76c8d8010ddee4c978fd2922c4f7
2020-09-09 16:03:27
24
58
d1b444bbb71ad0677c6c8a0c54f4d83af395d11a23b8b57996b7800bc39d1573
2020-09-03 15:56:35
17
57
7e914aad72ac00f362cdd8c2c5b6e1f75bb79fabc4ae3c102398d91b421922da
2020-08-24 14:30:15
11
56
e859eca7b098c258af61ca7281305a073af6cb6a4dbee8d0a606401120766553
2020-08-12 10:14:32
10
57
ac1971190e5d86201751707f5397a28082daa6ef2ad64e9e9132d3baf0fbc773
2020-08-11 16:12:10
16
57
4fe40c0fce8acf81cf8931afc6f99663c624c3adcab6f18d5303ebec7e78a27e
2020-08-11 16:12:10
17
59
51eef573db648e0335237a68ba54a9ee7ea2e169794a7660dbc7ecaacd505939
2020-08-07 11:29:41
9
58
dcc1997b25b004cf19029a598b34f57ca0db96cc7804819a3feeb58bba94630b
2020-08-03 18:08:28
17
59
b4e98e632304221726e96e50a51c16434eacc7162bc819e7a65f8a0ee423b4a1
2020-08-03 17:50:39
14
59
1a319dd115014eda77ff03792f8e5fab4caaacf006f5c859e727a3f8552338da
2020-08-03 01:51:51
25
60
22c2b0edeb83c36ad3757ff81c922df3fcc124c7da452ace9e932eb0125ddc2c
2020-08-02 11:59:14
14
57
915556b83991cb03f4a914a39019deeaabbedd302ac39853da2b63c3d5b9034c
2020-08-02 11:49:04
15
59
3d7eb9c7ff805cc814b49bd017814750eeec88d7e279352752bf30c081e61ca3
2020-08-02 11:14:50
16
57
a88df4093282b39c0da256be2f7cbc386f244437bd335b6162ee53a4fa1ff49f
2020-08-02 01:22:58
13
60
343dbfd7afac916f33722e47b2ea53c27c3e3d12349d5c4a78334d334d828708
2020-08-02 00:25:58
13
58
9ab8e58cc5affa8a284ef4aba285a660c49ce4787909c5aae484c50e95f4b8c4
2020-08-01 13:22:54
15
57
406de50fac767239221c639414230dd065c632f6a4d2492c3911bd954ebe0399
2020-08-01 08:19:37
16
58
9ae47ddf5eba12f7046852799cab8ddfe5e57aed64a773cd5bb05abf2fab9574
2020-08-01 00:02:56
14
56
68ca61e1a48b809d58ba8263592c89d4eb5dc7d4b56ad43b6a3e98efd7bc51db
2020-07-31 17:24:24
16
57
1bf5c34a804026a92863746bad4114ecbaa0a3929a3c369d15e42103bb853da2
2020-07-31 09:12:49
16
58
dcd04e8f0578261e57f0c4f6157bb2ff6359a7982ee1b3c792e1e293036f258e
2020-07-31 09:11:47
15
58
ee7362cef4aeab2f8758c8b8faba3a3251db7a95f8712a8bc8e7814f3b8fb575
2020-07-31 06:38:44
17
57
6bdeab07bb9e541820442c0c90f978a0489acdf7e0345a9d8e10c1f5e19a8268
2020-07-31 06:29:54
16
58
c862eebce3d48c8a678a0a3db0a9a88b8341b7093697dc04ba58ad3caeca9256
2020-07-31 05:35:58
14
58
f46b2576601c3253defb3e52d50a291642a78838fdf07cc5344902daafd5cfa7
2020-07-27 17:22:18
10
60
03d85ef968cad47c46ad5d2181163fce1b3e445a2ce6ae07253808c85d85dc89
2020-07-27 12:01:01
9
59
12ca64bca3a4161771c987ffe3541fbc8f0a7d663312a5332e440eb5b02b922a
2020-07-26 10:36:27
29
58
e96c29490b415926118a9342760a5060070e9dd415aee367cca7a0e5146a45fe
2020-07-24 04:43:01
18
60
ebd22380bcc142a98d9a410b822e3683a5e44382ec6985d9df00fcb71ac8dfe7
2020-07-23 14:04:43
9
58
0c192ff4ce93eb75379d620912c6bb01cd9fd748966e230f121d4405a8cca370
2020-07-23 12:49:22
15
59
3a8d9ee7040a681651d4aa948a9550d03b13d4e6287c7f5da7208edf5db882dc
2020-07-22 15:48:30
25
56
8142eca2250b41845205d1c4f29044bc6d242268b298a8f847b0df172b75cee7
2020-07-20 14:31:27
12
58
a7c4a64de46fd84d1314e4596966331d8d9faf2a1d0fca2b4984ef388ffeed8b
2020-07-18 09:39:45
16
59
7ead99e29db7a4d4e35106b0a92abd423b20eba039c45222b2390e711b64cb98
2020-07-18 04:14:04
12
59
2fe69009ec9acb729d68d1b31fb41513febdf9c4a7f28647a9422c231edb3708
2020-07-18 02:06:23
15
59
6c83c27c95ee85df53cc434b12365180d0978280f160e8eb4c2cf5fe7988541e
2020-07-18 01:49:18
15
60
9ef02806eaed522d8b863bb6fab6561e9c177366dec28bd022b4d82188e7ef45
2020-07-17 11:27:20
9
59
95198406bd1c27486041e58aeb88dad95f0e4cc48de00591da96707114b6e552

Rule Matches per Month (last 24 months)