Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Al Muhaidib Group KSA.Order With our Company Profile.doc.gz.exe
-
Size
313KB
-
Sample
220928-x3s97aaadl
-
MD5
624b5a402b803e5387ad3703512b6245
-
SHA1
c13ee0108903b3e3408db80e9d8b601f4831649b
-
SHA256
6cb6ca24a5438e646c710e6f4f0c7f4f79d12faa9cf647e89a215083eea45417
-
SHA512
cc7d20501feadf1599f936d8bba67973c052af9c99a617efde1b3d56b7c3b6b4be86865e924b25efbf2bb1486355bcff07c52459d7da5b202b0c701087daab8b
-
SSDEEP
6144:Mnfj51HnOQ7hseU+3FfVpJem0rHkMMQNI2tK+u:+5tnnN13FbEkOpK
Static task
static1
Behavioral task
behavioral1
Sample
Al Muhaidib Group KSA.Order With our Company Profile.doc.gz.exe
Resource
win7-20220812-en
Malware Config
Extracted
formbook
r4am
7s+N0ZPIJ9VpqrvtKksXc7XuyWQV
b10VlJxyr+gCSypTPq+ttg==
p38gcQiwILmDccYrmbc=
J/ORoE40XwuxoUBl0DCnAjg=
waVc3Ur4Ig/2N0Ju2wG1DbgtjWxhIxs=
yp97AnUvgTnkTw4b
mYElQRz+60TcJwkmpAqVnYfUymE=
aUfuNJdSXN/qNxE/cpiTmoTL/4cd
aR/gJFPYz8rH+cVCjpty
xY45ukYcf0olJqofG75t
TBq3DAxHoNxz8qesW9Ft
TTP/Dhhszw/D8kZdFg==
qHgNTp0fYKBi19z346EcuNxg
A83SygeBE+V16/U=
LOesLh1Ykw8BKSmyaV1l
y6paCH8rmVAlJQ==
vYwzUX3wKXJGnWGyaV1l
lXVE0tXBtEtmmVeyaV1l
dV80xnHwI1aoF/MR
AN1o76cpYJhWVyFS1TCnAjg=
XC+mtHyKvtrTBtZPjHItQzA=
MhPbG9oQez4sWypZVvizCdbL/4cd
EuipPcw2Li8rVxxOPq+ttg==
5tGBmtBmqiLm45ujn0ADWX3IRA==
xYc0iJHgRYc1cgtTDw==
cVsEVMkoCP7hEwcUU25prmOozBG5wA==
bjK5zQBunMZxaiItrgTMHQp5
1L+S7OS/nBcBKimyaV1l
3q6H4EkMVFLsMQpSDQ==
LwewNkZAObii4usU0znk5G7tTSgg8Ag=
az3xS19SNuV16/U=
r3wfMG8SSMzS6jtGBQ==
OP/DUm9pS7J/+sYrmbc=
0pUXXjZh1p9rdgwxncFrtf4ohmhVBhE=
RDHicg15UUQVcHWrdRkMVZD+XQ==
It6DBZMHFuOhnYeobAv2MtRDjWhVBhE=
4LteqavxJpV3mV5tW0o8dkmozBG5wA==
mnw1uV3PnouOu4zQhSoVVZD+XQ==
9ueX2g2BmVAlJQ==
jwLuBD+nUAD/
MxXFRkIsZhez/sYrmbc=
p4U4wlQogy/WyT6AT6A=
07Zv9fMD3MR8afdCjpty
BNKQJpJfJuV16/U=
qp02vMiynyT7/b/uK1IcuNxg
MviGCDCO7oFg3cQaSbmCDD4=
h1sctJvTvjLaIE2yaV1l
3qVCgzUrDndFvZYWi64=
knI8nuDpTSQ=
Dfum8NMEb7pUK8TXlYH6sunaS2k=
m31BzNC6/sOP/sYrmbc=
i0TvPiVjzHmfnCs9Pq+ttg==
MxfTJ38I7Ou3ECWyaV1l
l18Xm6eehQYChkdRDA==
Dguz+3HlzdjqF/IpqBH/VZD+XQ==
sZU1SihglhMT77rypVJKeOnaS2k=
hVpNGsoFXMvbX9xTUiwZVZD+XQ==
k1IrZzBk1fwDcgtTDw==
wKMZkRp/mVAlJQ==
Y04PlRt/mVAlJQ==
oZFQlMZNNj05YitOPq+ttg==
f0sKoFX0XKY8DcdCjpty
VAGv9/4DdPX1
KAfI3iCj0A7N1Z7DdhH/VZD+XQ==
authorsong.com
Extracted
xloader
3.8
r4am
7s+N0ZPIJ9VpqrvtKksXc7XuyWQV
b10VlJxyr+gCSypTPq+ttg==
p38gcQiwILmDccYrmbc=
J/ORoE40XwuxoUBl0DCnAjg=
waVc3Ur4Ig/2N0Ju2wG1DbgtjWxhIxs=
yp97AnUvgTnkTw4b
mYElQRz+60TcJwkmpAqVnYfUymE=
aUfuNJdSXN/qNxE/cpiTmoTL/4cd
aR/gJFPYz8rH+cVCjpty
xY45ukYcf0olJqofG75t
TBq3DAxHoNxz8qesW9Ft
TTP/Dhhszw/D8kZdFg==
qHgNTp0fYKBi19z346EcuNxg
A83SygeBE+V16/U=
LOesLh1Ykw8BKSmyaV1l
y6paCH8rmVAlJQ==
vYwzUX3wKXJGnWGyaV1l
lXVE0tXBtEtmmVeyaV1l
dV80xnHwI1aoF/MR
AN1o76cpYJhWVyFS1TCnAjg=
XC+mtHyKvtrTBtZPjHItQzA=
MhPbG9oQez4sWypZVvizCdbL/4cd
EuipPcw2Li8rVxxOPq+ttg==
5tGBmtBmqiLm45ujn0ADWX3IRA==
xYc0iJHgRYc1cgtTDw==
cVsEVMkoCP7hEwcUU25prmOozBG5wA==
bjK5zQBunMZxaiItrgTMHQp5
1L+S7OS/nBcBKimyaV1l
3q6H4EkMVFLsMQpSDQ==
LwewNkZAObii4usU0znk5G7tTSgg8Ag=
az3xS19SNuV16/U=
r3wfMG8SSMzS6jtGBQ==
OP/DUm9pS7J/+sYrmbc=
0pUXXjZh1p9rdgwxncFrtf4ohmhVBhE=
RDHicg15UUQVcHWrdRkMVZD+XQ==
It6DBZMHFuOhnYeobAv2MtRDjWhVBhE=
4LteqavxJpV3mV5tW0o8dkmozBG5wA==
mnw1uV3PnouOu4zQhSoVVZD+XQ==
9ueX2g2BmVAlJQ==
jwLuBD+nUAD/
MxXFRkIsZhez/sYrmbc=
p4U4wlQogy/WyT6AT6A=
07Zv9fMD3MR8afdCjpty
BNKQJpJfJuV16/U=
qp02vMiynyT7/b/uK1IcuNxg
MviGCDCO7oFg3cQaSbmCDD4=
h1sctJvTvjLaIE2yaV1l
3qVCgzUrDndFvZYWi64=
knI8nuDpTSQ=
Dfum8NMEb7pUK8TXlYH6sunaS2k=
m31BzNC6/sOP/sYrmbc=
i0TvPiVjzHmfnCs9Pq+ttg==
MxfTJ38I7Ou3ECWyaV1l
l18Xm6eehQYChkdRDA==
Dguz+3HlzdjqF/IpqBH/VZD+XQ==
sZU1SihglhMT77rypVJKeOnaS2k=
hVpNGsoFXMvbX9xTUiwZVZD+XQ==
k1IrZzBk1fwDcgtTDw==
wKMZkRp/mVAlJQ==
Y04PlRt/mVAlJQ==
oZFQlMZNNj05YitOPq+ttg==
f0sKoFX0XKY8DcdCjpty
VAGv9/4DdPX1
KAfI3iCj0A7N1Z7DdhH/VZD+XQ==
authorsong.com
Targets
-
-
Target
Al Muhaidib Group KSA.Order With our Company Profile.doc.gz.exe
-
Size
313KB
-
MD5
624b5a402b803e5387ad3703512b6245
-
SHA1
c13ee0108903b3e3408db80e9d8b601f4831649b
-
SHA256
6cb6ca24a5438e646c710e6f4f0c7f4f79d12faa9cf647e89a215083eea45417
-
SHA512
cc7d20501feadf1599f936d8bba67973c052af9c99a617efde1b3d56b7c3b6b4be86865e924b25efbf2bb1486355bcff07c52459d7da5b202b0c701087daab8b
-
SSDEEP
6144:Mnfj51HnOQ7hseU+3FfVpJem0rHkMMQNI2tK+u:+5tnnN13FbEkOpK
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-