Monday, April 12, 2021

Malware Analysis - Google Docs to DocX to XLSB

 got this email



Link was google drive

Sender: sunringpal33@gmail.com
Subject: A full documents 9674
X-Originating-IP: [209.85.160.196]
Time: 04/09/21 12:43:33
Malware: Phish.LIVE.DTI.URL
URL: hxxps://drive.google[.com/uc?export=download&id=1Z50lnHAW8NKIOL8cvpubm0iaYNHbWqKu
downloaded MD5: fddea65d6393155f25c9fd004e47df83
downloaded Filename: d7653901.docx

which downloads a word doc





Which has another link in it

hxxps://accounting.marayo[.]com/loved.php





Which downloads an Excel doc and redirects to DocuSign






Which the excel doc has macros and looks like this DigiCert fake




Which has a hidden sheet




Which is you change the font color or copy / paste entire contents to notepad++ you'll see the Macro code and a payload url 

hxxps://masterize[.]com[.]br/vendor/laravel/framework/src/Illuminate/Foundation/Console/scmcs.exe

wmic.exe






https://drive.google.com/uc?export=download&id=1Z50lnHAW8NKIOL8cvpubm0iaYNHbWqKu

w



6 comments:

  1. Are you in need of finance? we give out guarantee cash at 3% interest rate. Contact us on any kind of finance now: financialserviceoffer876@gmail.com whatsapp Number +918929509036 Dr James Eric Finance Pvt Ltd

    ReplyDelete
  2. I was thrown out of my own house was sleeping in a hotel for weeks she also took possession of my son could only see him once a week then I found out she was in love with my accountant all these while so I went online and I came across a Russian private investigator who help me get all my properties and my accounts back even my company back how he did these I don’t know but I gave all the information he asked for and followed all his instructions and now I’m happy my life’s better now.
    Thanks to HACKINTECHNOLOGY@CYBERSERVICES.COM
    I just said I should share my own story here
    Thank you

    ReplyDelete
  3. Never met any hacker as discreet and fast like this White Collar Hackers. They are called WhiteHats and they has helped me in multiple ways first was when my ex spouse cheated on me- they got me every information from my spouse phone number and now they are helping me paying my credit cards debts. They have the best hacking tools plus service any one can ever imagine and I recommend him to the world. I am thankful and grateful for the second chance. Honestly, WhiteCollar hackers are life savers please contact them here if you need their swift service Email; WhitehatspytechATcyberservicesDOTcom

    ReplyDelete
  4. I know of a group of private investigators who can help you with they are also hackers but prefer to be called private investigators They can help with your bitcoin issues and your clients will be happy doing business with you,they can also help yo with your bad credit score,hacking into phones,binary recovery,wiping criminal records,increase school score, stolen files in your office or school,blank atm etc. Just name it and you will live a better life
    Contact +1(407) 777-4240
    Premiumhackservices@gmail.com

    ReplyDelete
  5. Grand Maître spirituel Bossou il va vous aider partout où que vous soyez dans tous les domaines comme :Amour - tendresse - fidélité conjugale - retour de l'être aimé - rencontre d'un nouvel amour - Argent - Chance aux jeux - Trouver du Travail - Examens - Réussite dans la vie professionnelle - Protection contre le mal - désenvoûtement - impuissance sexuelle - guéri les maladies inconnues, etc..Voici ces contacts

    Tel ou whatsapp: +229 64 04 44 23
    https://dah-bossou.weebly.com/

    ReplyDelete
  6. He is the best out there,I tested him and he delivered a good job,he helped me settle bank loans,he also helped my son upgrade his scores at high school final year which made him graduate successfully and he gave my son free scholarship into the college,all I had to do was to settle the bills for the tools on the job,I used $500 to get a job of $50000 done all thanks to Robertson he saved me from all my troubles,sharing this is how I can show gratitude in return for all he has done for me and my family

    Contact premiumhackservices@gmail.com

    Text/call ‪+1 (984) 733‑3673‬

    WhatsApp ‪+1 (984) 733‑3673‬

    Telegram ‪+1 (984) 733‑3673‬

    ReplyDelete