Overview
overview
4Static
static
1安天/审...z.docx
windows7-x64
4安天/审...z.docx
windows10-2004-x64
1安天/审...r.docx
windows7-x64
4安天/审...r.docx
windows10-2004-x64
1安天/审...w.docx
windows7-x64
4安天/审...w.docx
windows10-2004-x64
1安天/附..._.docx
windows7-x64
4安天/附..._.docx
windows10-2004-x64
1安天/附...U.docx
windows7-x64
4安天/附...U.docx
windows10-2004-x64
1安天/附...�.docx
windows7-x64
4安天/附...�.docx
windows10-2004-x64
1秦易黑�...e.docx
windows7-x64
4秦易黑�...e.docx
windows10-2004-x64
1秦易黑�...y.docx
windows7-x64
4秦易黑�...y.docx
windows10-2004-x64
1观宇战�...E.docx
windows7-x64
4观宇战�...E.docx
windows10-2004-x64
1观宇战�...�.docx
windows7-x64
4观宇战�...�.docx
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
安天/审核通过/0day-农业机械试验鉴定信息化服务平台未授权文件上传导致g_152852_L_72597_pgLU7yfz.docx
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
安天/审核通过/0day-农业机械试验鉴定信息化服务平台未授权文件上传导致g_152852_L_72597_pgLU7yfz.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
安天/审核通过/0day-农产品质量安全监管网未授权文件上传导致getshe_145943_L_72597_LUmJhmYr.docx
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
安天/审核通过/0day-农产品质量安全监管网未授权文件上传导致getshe_145943_L_72597_LUmJhmYr.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
安天/审核通过/人大信访系统绕过登录后台文件上传导致getshell漏洞_142937_L_72597_2Dw9vBqw.docx
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
安天/审核通过/人大信访系统绕过登录后台文件上传导致getshell漏洞_142937_L_72597_2Dw9vBqw.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
安天/附件/0day-农业机械试验鉴定信息化服务平台未授权文件上传导致g_152852_.docx
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
安天/附件/0day-农业机械试验鉴定信息化服务平台未授权文件上传导致g_152852_.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
安天/附件/0day-农产品质量安全监管网未授权文件上传导致getshe_145943_L_72597_LU.docx
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
安天/附件/0day-农产品质量安全监管网未授权文件上传导致getshe_145943_L_72597_LU.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
安天/附件/人大信访系统绕过登录后台文件上传导致getshell漏洞_142937_L_72597_2Dw9vBqw_0day省人大.docx
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
安天/附件/人大信访系统绕过登录后台文件上传导致getshell漏洞_142937_L_72597_2Dw9vBqw_0day省人大.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
秦易黑霾实验室/审核通过/陕西省政府门户网站0day_155206_L_72597_sXuAgKBe.docx
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
秦易黑霾实验室/审核通过/陕西省政府门户网站0day_155206_L_72597_sXuAgKBe.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
秦易黑霾实验室/附件/陕西省政府门户网站0day_155206_L_72597_sXuAgKBe_政府门户网站注入0day.docx
Resource
win7-20241023-en
Behavioral task
behavioral16
Sample
秦易黑霾实验室/附件/陕西省政府门户网站0day_155206_L_72597_sXuAgKBe_政府门户网站注入0day.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
观宇战队/审核通过/全国消防综合业务平台通用0day_120132_L_72597_BWP32y3E.docx
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
观宇战队/审核通过/全国消防综合业务平台通用0day_120132_L_72597_BWP32y3E.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
观宇战队/附件/全国消防综合业务平台通用0day_120132_L_72597_BWP32y3E_全国消防综.docx
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
观宇战队/附件/全国消防综合业务平台通用0day_120132_L_72597_BWP32y3E_全国消防综.docx
Resource
win10v2004-20241007-en
General
-
Target
0d2550dd62ff770b199e1843e64d433c426fc7412c2602956b56567fd41806c4
-
Size
10.1MB
-
MD5
08513189b1b99c2857c65c7c69c0dca6
-
SHA1
a27868732844fb895c7a63b6809209b6c819b883
-
SHA256
0d2550dd62ff770b199e1843e64d433c426fc7412c2602956b56567fd41806c4
-
SHA512
683688fa38fa59bf20c935a8ba630343ac8e72702105c5d8c470ab6bc51afc919260e2fb8397edf414a9c26764c8b7372fdaf29376f343790deffebf24d6acbd
-
SSDEEP
196608:EB0b73DDzMCuVrNoHxM+lYxDTdqjdKRGKNW8io4xZxsm68jdQ0czPUnWr:E6b7Tn9uVrNJPxVqZKR485IsojZc7UA
Malware Config
Signatures
-
Office document contains embedded OLE objects 3 IoCs
Detected embedded OLE objects in Office documents.
resource yara_rule static1/unpack001/安天/附件/0day-农业机械试验鉴定信息化服务平台未授权文件上传导致g_152852_L_72597_pgLU7yfz_0day-农业机械试验鉴定信息化服务平台未授权文件上传导致getshell漏洞.docx office_ole_embedded static1/unpack001/安天/附件/0day-农产品质量安全监管网未授权文件上传导致getshe_145943_L_72597_LUmJhmYr_0day-农产品质量安全监管网未授权文件上传导致getshell.docx office_ole_embedded static1/unpack001/安天/附件/人大信访系统绕过登录后台文件上传导致getshell漏洞_142937_L_72597_2Dw9vBqw_0day省人大.docx office_ole_embedded
Files
-
0d2550dd62ff770b199e1843e64d433c426fc7412c2602956b56567fd41806c4.zip
-
安天/审核通过/0day-农业机械试验鉴定信息化服务平台未授权文件上传导致g_152852_L_72597_pgLU7yfz.docx.docx office2007
-
安天/审核通过/0day-农产品质量安全监管网未授权文件上传导致getshe_145943_L_72597_LUmJhmYr.docx.docx office2007
-
安天/审核通过/人大信访系统绕过登录后台文件上传导致getshell漏洞_142937_L_72597_2Dw9vBqw.docx.docx office2007
-
安天/附件/0day-农业机械试验鉴定信息化服务平台未授权文件上传导致g_152852_L_72597_pgLU7yfz_0day-农业机械试验鉴定信息化服务平台未授权文件上传导致getshell漏洞.docx.docx office2007
-
安天/附件/0day-农产品质量安全监管网未授权文件上传导致getshe_145943_L_72597_LUmJhmYr_0day-农产品质量安全监管网未授权文件上传导致getshell.docx.docx office2007
-
安天/附件/人大信访系统绕过登录后台文件上传导致getshell漏洞_142937_L_72597_2Dw9vBqw_0day省人大.docx.docx office2007
-
秦易黑霾实验室/审核通过/陕西省政府门户网站0day_155206_L_72597_sXuAgKBe.docx.docx office2007
-
秦易黑霾实验室/附件/陕西省政府门户网站0day_155206_L_72597_sXuAgKBe_政府门户网站注入0day.docx.docx office2007
-
观宇战队/审核通过/全国消防综合业务平台通用0day_120132_L_72597_BWP32y3E.docx.docx office2007
-
观宇战队/附件/全国消防综合业务平台通用0day_120132_L_72597_BWP32y3E_全国消防综合业务平台通用0day.docx.docx office2007
-
说明文件.txt