Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
PO-230102_May 2023.exe
-
Size
222KB
-
Sample
230508-s7vllabd94
-
MD5
41b41296821338a634d99d5b5c749ec1
-
SHA1
747470c76d47d50eaaa891edcc2f17b22b07d1c9
-
SHA256
272872a41e4e0ae720f6f61e50320720cf0313fe65d4c039334ed6c0cb7f37b0
-
SHA512
7e6e6892661051c9135ca042bc0af85dbbee366080ac326893a62666c4f54401bf1111b1c60c300f3a29b9ad26dfd71848a622215917f739d29ad882451e5ed0
-
SSDEEP
3072:d0gHHDGWvgDE4u+gCGHjEmELWQ88ffVls4:WkDBuEawAWE3Vls
Static task
static1
Behavioral task
behavioral1
Sample
PO-230102_May 2023.exe
Resource
win7-20230220-en
Malware Config
Extracted
formbook
4.1
g3th
casemierlawncare.com
715harrison.com
laiwudj.com
jhy6id3bgsu.cfd
gewnaj.xyz
hullo.social
animejoyy.com
florenceodd.click
accountingassociatesil.com
cxuu39.shop
isabelladowns.com
checkstart.net
b2bmails.ru
wehantz.com
thejjwhyte.com
jerusalemfoundationsusa.com
newagreement19.com
findel.xyz
czanniversaryring.com
ape5n.com
historyszhuayears.com
homeseller.tips
storagerelax.com
internetsniandoing.com
erolemir.xyz
hsrnithplc.com
gundemozet.net
androidtau.com
adinf.co.uk
dgecai.cyou
csymd.com
lenaandbalazs.com
efefalive.buzz
kenyagov.info
thereallifeguild.net
affixbleach.online
dnsketoaqz.bar
primewindowsorigin.co.uk
amusangdam.xyz
halfpriceexams.com
locksmithexpressny.com
afifitravel.com
dn789slot.net
freshvoices.media
jhklk6565.site
ogdams.africa
monsters.boo
fastezsolar.com
diamond-parkplaza.com
bioup.xyz
printpig.co.uk
mocka.app
merxew.xyz
cndsmail.com
fuel-43574.com
38gaokk.com
bcrzyy.cfd
cactusreefranch.com
aidaomur.com
barangayzone6.tech
gmx-yy.com
bd0371.com
znjf.net
ecoenerone.com
fishingfound.work
Targets
-
-
Target
PO-230102_May 2023.exe
-
Size
222KB
-
MD5
41b41296821338a634d99d5b5c749ec1
-
SHA1
747470c76d47d50eaaa891edcc2f17b22b07d1c9
-
SHA256
272872a41e4e0ae720f6f61e50320720cf0313fe65d4c039334ed6c0cb7f37b0
-
SHA512
7e6e6892661051c9135ca042bc0af85dbbee366080ac326893a62666c4f54401bf1111b1c60c300f3a29b9ad26dfd71848a622215917f739d29ad882451e5ed0
-
SSDEEP
3072:d0gHHDGWvgDE4u+gCGHjEmELWQ88ffVls4:WkDBuEawAWE3Vls
-
Formbook payload
-
Suspicious use of SetThreadContext
-