Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
REF_10113127.doc
-
Size
189KB
-
Sample
231102-ym4lnaef41
-
MD5
856f8fd3fd99c87c15057baedea5abda
-
SHA1
5608ef791ef83c243949549099a4435c1c728e44
-
SHA256
091c56138984569435a05540b0fc6d9bcaae31a5a2a7adaf3f91e2614a7cfe42
-
SHA512
2a434703de11f71f07e2bd094e316ed7ecac18a156b0adc58249513990f2c238b7418b762b74ef4677a48953ffd6030f3a69ba9a7b9309b9166a9a7187c59197
-
SSDEEP
768:YwAbZSibMX9gRWjQPWuoPAAslwcqEyiHM/j6s:YwAlRLWuoPAAGMEyt76s
Static task
static1
Behavioral task
behavioral1
Sample
REF_10113127.rtf
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
REF_10113127.rtf
Resource
win10v2004-20231020-en
Malware Config
Extracted
formbook
4.1
btrd
toulouse.gold
launchyouglobal.com
margarita-services.com
dasnail.club
casa-hilo.com
hardscapesofflorida.com
thepositivitypulse.com
kkmyanev.cfd
love6ace22.top
castorcruise.com
chch6.com
h59f07jy.cfd
saatvikteerthyatra.com
fxsecuretrading-option.com
mostbet-k1o.click
36-m.beauty
ko-or-a-news.com
eurekatextile.com
gynlkj.com
deepsouthcraftsman.com
bougiebossbabe.com
202402.xyz
thecareskin.com
zimmerli.online
bathroomconnectsupreme.com
opmk.monster
docemimocasamentos.com
mywayinist.com
healthyters.com
mozartchamberorchestra.sydney
wewillrock.club
education2jobs.com
everlastdisposal.com
valentinascrochet.com
stewartvaluation.net
blackphoenix01.xyz
omnikart.shop
jejeesclothing.com
allurepet.site
futureofaustin.com
sillylittlestory.com
inthewoodsdesigns.com
freshtraining.store
illuminati4me.com
jewishlakecounty.com
devadecoration.com
nashexshop.com
martline.website
affirmationtotebags.com
golifestyles.com
telegood.info
trygenesisx.com
bestwhitetee.com
delicatemayhem.com
redyardcom.com
solarcyborg.com
emotieloos.com
fanatics-international.com
ballonsmagiques.com
projektincognito.com
fcno30.com
horizonoutdoorservices.com
couturewrap.com
mbbwa4wp.cfd
lifeofthobes.uk
Targets
-
-
Target
REF_10113127.doc
-
Size
189KB
-
MD5
856f8fd3fd99c87c15057baedea5abda
-
SHA1
5608ef791ef83c243949549099a4435c1c728e44
-
SHA256
091c56138984569435a05540b0fc6d9bcaae31a5a2a7adaf3f91e2614a7cfe42
-
SHA512
2a434703de11f71f07e2bd094e316ed7ecac18a156b0adc58249513990f2c238b7418b762b74ef4677a48953ffd6030f3a69ba9a7b9309b9166a9a7187c59197
-
SSDEEP
768:YwAbZSibMX9gRWjQPWuoPAAslwcqEyiHM/j6s:YwAlRLWuoPAAGMEyt76s
-
Formbook payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-