Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Foreign Payment swift_pdf.js
-
Size
342KB
-
Sample
221017-qvp48sbhf2
-
MD5
4e474a544aa97316f1f1ddf56e9c5c70
-
SHA1
b9775c6cf7a5c6c74b8d9ed1776d35a5a1d8f494
-
SHA256
46af67f4a2a2c3d7bc6d8743941718c5abd1f3cacb0dd08f9a4c24651a843752
-
SHA512
4ba58f40318d2582c43e84acb993bb8e9684a3b3955e771043e0742e309020e5482b6aeb5d437dea6c4ecd31ffcf9d6df8693b268c5ac187ba866c4f04d2fbaa
-
SSDEEP
6144:q8OjK5gRBwhZ2FlbDsmxSvODgTEqEqSMa7Z3tFuQilEI64OHdlG:buKJUlHLxSWDyREqSMstFclEz37G
Static task
static1
Behavioral task
behavioral1
Sample
Foreign Payment swift_pdf.js
Resource
win7-20220812-en
Malware Config
Extracted
formbook
xrob
dV8FCtdWdnfMJ9thh8l/
IJG6Bh4iMeHVBHNp2MrpTA==
NhPKKtmQxnHYF/80
f4M2RhGEf3Ot13+qLrKqxb9f3dXj9Q==
A/689/MibSRBgkPkx07m+H+g
e8OOkUu9y/uYCMsdrR3s0mODmGw3d8t9Og==
gLN5bn+Zq1VQXmOOvw==
NFcQGvViY5sxmkty83Fde4GQhg==
XWMfFSM3f7GT9w==
Ih6vvqf9R8gDObM=
FGAlLASHlpLaUUKUJIwm9ABQ2Js=
v8R615LDC8iWchwv
m+u3rLUxScgDObM=
jc3eahERf7GT9w==
TYNBVDadkpTF76HeNl/rbwWtLSbyPzM=
j6NQmhWeOi2B
aqJocUfM3v97ryScY6EiSMbVyBak
V7nYOyEZKa2J/KKh5RMhJrbyK/eC/Q==
8zPsAt3ejcgDObM=
Rpe+BrGBzpGa9q8FHKpi
/WmW2322D7fNRPTILa58Juqk/ZM=
+RXDz2RnrG6J
G2uU9LualUtez4NigNITbgyuIybyPzM=
edeuu22xD1rTFu+ci/JLpyGuIybyPzM=
pP8hbRJZqelZrXS+HWDm+H+g
8STQ6HSb4lE4XmOOvw==
hr/lDpXMc4jYF/80
zQ/HzrVdryLZMvhEZ+Y=
HV4gPCecmZPFL8v1N6x1
LEf38qRZvLgqVfTXPa19
7euZ5pxpp2ZtrYb1N6x1
iqU5LgL782FBXmOOvw==
gtbwN+MldLRNoQZhh8l/
WUgMbA3KHBFYvlM6xk7m+H+g
b1zuBfz/FgrL92U4
Q6jeIxKBj5a+66DmTJCE7LZkK/eC/Q==
5BnV1pTXMa+W8aXGFVdhe4GQhg==
0UIRgvizzg8=
Cf/BDgD1/4JpqGQveZhw
+SPb0ojBEZzzTLk=
1ihEmlgPYYcJPPhEZ+Y=
va9ioKotR8gDObM=
66NR6ZvZGVfLLgOkSXLm+H+g
s7Ftp5/JE9zxPsv1N6x1
OZjAEbHmQr57flVNog==
SWYQJhbPGKdlXmOOvw==
D2UxQCXKFoVIoSu9IHUrWw==
ISLrKBL7AbPbCiJc5FAkMhM=
yhErdYm07KzDN9oFHKpi
vL5nTlhRf7GT9w==
p/wcbinhJe3eP90FHKpi
JCG1tJvLI+MUMwHVtw==
YKGzBi9gqWJ7tXgqW9cve4GQhg==
GzDd8t2F3lM7nzQw0Urm+H+g
gHo/fQEoa6tAVjiEqA==
zQ7U6cY1RYcJPPhEZ+Y=
BEEFEwEwYhkxlEUD+TMJnhs=
wfubpSsNjM5t4sOGqWbFp+K6pc/n9Q==
NntHSf0ybNuawX/q4Blh68nzK/eC/Q==
BVRywXVfdfjPK+DImLD3SQBQ2Js=
pOOyL/izzg8=
2c2Sxo8iuKv0L78=
wRU0iU8CRLSS9Q==
+Sjk78IvKRNv364HcZ4l+bAXxhes
pauloeamanda.com
Targets
-
-
Target
Foreign Payment swift_pdf.js
-
Size
342KB
-
MD5
4e474a544aa97316f1f1ddf56e9c5c70
-
SHA1
b9775c6cf7a5c6c74b8d9ed1776d35a5a1d8f494
-
SHA256
46af67f4a2a2c3d7bc6d8743941718c5abd1f3cacb0dd08f9a4c24651a843752
-
SHA512
4ba58f40318d2582c43e84acb993bb8e9684a3b3955e771043e0742e309020e5482b6aeb5d437dea6c4ecd31ffcf9d6df8693b268c5ac187ba866c4f04d2fbaa
-
SSDEEP
6144:q8OjK5gRBwhZ2FlbDsmxSvODgTEqEqSMa7Z3tFuQilEI64OHdlG:buKJUlHLxSWDyREqSMstFclEz37G
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-